Spam or not?

[jducoeur]

[Poll #1730537]

ETA: Okay, poll is now done enough, and the spammy comment has been deleted. For future reference the account in question was "nodeshop". Still not quite sure what its game is, but it appears to be fronting a bot of some sort...

Comments

[la-peregrina.livejournal.com]

I got something very similar in one of my posts last night. I think it is spam.

[jenwrites.livejournal.com]

I've been getting those as well. They're clearly some sort of automagic crap that has nothing to do with the post in question.

[canthelpyou.livejournal.com]

I'll believe it's spam, but it's a singularly pointless spam. Is someone going around giving random encouragement to strangers for some sinister purpose, or out of a desire to spread happiness and encouragement?

[herooftheage.livejournal.com]

I'm wondering if it's part of the DDOS attack, with the idea that by making "real" comments, an account might escape detection as an attacker.

[tashabear.livejournal.com]

Ban his ass and report him as a bot. It's the only way to be sure. (I've had two, so far, on the same post from 2005.)

[hugh-mannity.livejournal.com]

I think it's spam of some sort.

Googling the phrase gets 3 1/2 million hits. :(

[talvinamarich.livejournal.com]

I did a Google Search for "Nodeshop" in an attempt to see where else they are commenting, and the results I got imply pretty heavily that there is a spamming company by that name. And it looks like a sock puppet account. Spam.

[owlbait.livejournal.com]

I suspect there is something wonky in the user profile - which you might click on in the process if figuring out who this person is.

[oakleaf-mirror.livejournal.com]

It depends how you define spam. I generally assume a payload is attached to spam, in the form of a link to some site or service on the net, and they're trying to get you to click. This seems payload free, both in the comment, and the profile and journal of the poster. I do believe this is automatically posted from some sort of a bot, but the purpose is a mystery to me. It might be the internet equivalent of shortwave numbers stations.

[hudebnik.livejournal.com]

I've gotten at least half a dozen posts like this in recent weeks -- all short, flattering, and generic enough that they could have been about almost any conceivable post. And all from accounts with no friends and no posts.

[fosveny.livejournal.com]

Did you check the account?

That account has no friends, is a member of no communities, nothing.

Spam.

[jducoeur]

Oh, I checked the account. But that's part of why I'm mystified: it smells very much like spam, but I can't find *motive* anywhere. I expected to find spam-links in the profile, but there's nothing -- none of the usual markers of why someone runs this sort of comment-spam. It's really rather odd...

[goldsquare.livejournal.com]

During DDOS attacks, you think content-less comments from ghost accounts are innocuous?

I see them as heavyweight tools for overloading servers - or test accounts for same.

[jducoeur]

Hmm. Possible, although it doesn't strike me as a very *good* DDoS technique. Do LJ's servers not have a "no comments at this time" switch? I think of that as a fairly standard firebreak in systems like this: put them into read-only mode for a little while, while you block off the attackers.

And I'd be quite disappointed if they don't have limiters on how frequently a given account can post/comment -- that's basic table-stakes security. (Heck, we implemented that at Convoq, and never had more than 1000 users in practice.)

I think dsrtao's hypothesis about comment-spam probes seems more plausible, and certainly matches common comment-spam techniques, although again it mostly seems like a way to just get the account shut down. Doing a little Googling around, this account does seem to be posting entirely "generic" comments like this, although with surprisingly high variability...

[goldsquare.livejournal.com]

As true as all that is, you are treating DDOS as a choice. I see a truly hostile DDOS attack as being additive: using all tools, all APIs, all methods.

[rufinia.livejournal.com]

The theory I heard that if there's some reaction to the random comment, that indicates to the owner of the bot that the journal is active and ripe for more pointed spammy attacks in the future.

[dsrtao]

If there's no reaction, it's unmonitored and can be used for SEO spam.

[jducoeur]

Ahhh -- now *that* is an interesting theory. It does seem plausible that this could be an initial probe: that's not an unusual tactic for comment spammers...

[jdulac.livejournal.com]

I've had two such comments recently on very old posts in my Gouberville journal. It's spam.

[dlevey.livejournal.com]

Generic comment, not really appropriate for the post (as it was the retelling of a dream), new user profile (about 2 months) but no posts, no friends, nothing else...

[aishabintjamil.livejournal.com]

This seems to bear some resemblance to a comment left on my LJ yesterday (http://aishabintjamil.livejournal.com/20224.html, last comment). It's sort of generic - says I have a great site and they're taking my RSS feed. Now I don't have an RSS feed on my LJ, but the post did include a link to my publisher's web site, and they do have a feed. So it's not completely off the wall, but it does seem a little odd.... Taken together with your experience, I'm seeing a pattern.

FWIW, the account from which the comment was left has nothing in its friends list for LJ announcements, writer's block, etc. and has no posts of its own. Something's up here.

[jducoeur]

Yep -- the profiles are effectively identical. Okay, so it's clear that there's a bot of some sort at work here. But I still haven't come up with a good reason why...

[hfcougar.livejournal.com]

metahacker was complaining of this just the other day.

[cvirtue.livejournal.com]

I had no clear opinion, but I found the discussion interesting.

[cellio]

I've gotten a bunch of those in recent weeks, and noticed today that the "mark as spam" check-box is no longer there when I delete them. Hmm.