8

I'm moderator in a very small forum. It has areas for many different IT-related topics (in German), and several sub-forums (in English) that serve as support areas for various open source libraries. Therefore, the forum is open for everyone, without registration: Completely anonymous posts are allowed, so that people don't have to register only to ask something about one of the libraries.

Of course, the usual cat-and-mouse game between spammers and good guys is played. I am not an administrator, and not familiar with the technical infrastructure behind this. But there are some CAPTCHA-like hurdles for posting, some blacklists, and "suspicious" posts may have to undergo a moderator review before being published.

It's working quite well. The classical advertising spam is usually caught, and only occasionally one of them appears as "moderated" and is then deleted by a moderator.

But recently, there have been ... "non-classical" spam posts: Anonymous posters have posted greetings. These, of course, went through all security nets, because they are basically perfectly legitimate posts - one recent example:

Hi!

I'm Will from Bosnia :-) I'm pretty sure we can enjoy a lot of great moments with each other :-)

See you on the other topics!

In fact, I once did keep (and not delete) some of them, because I thought that they might really be legitimate. But there are reasons to assume that these are "spam" posts: They are posted in arbitrary sub-forums, sometimes even as answers to other posts. The posters seem to be never seen again afterwards. There is a very small communtiy of registered/regular users, but this group is posting only in German, so it's nearly impossible that someone just wants to join us by posting anonymously and in English. These posts seem to be created from various IP addresses, and - apologies for the possible cliché - not ru, in or cn ones.

I thought that these posts might be sorts of "tracing bullets": A spam bot does the post, and if it's still there after a while, it assumes that the forum is unmoderated and it starts to flood it with "real" spam. But this seems unlikely.

Can anybody imagine what could be the purpose of these posts?

EDIT: Another moderator indirectly pointed out the result of googling for "I'm Will from Bosnia", which strikingly confirms that these are spam posts. The purpose is still not clear, but the answers already list some options.

Improve this question

2 Answers 2

Reset to default
8

That "tracing bullet" theory is not unlikely at all. Automatic spambots often try to figure out how posting on the website works technically. They do that by entering a message into every form field they find and then re-spider the whole website to see if the input they made appears somewhere. This works better when the messages they use are designed to not get filtered by some automatic spam filter. After the bot found out how to place messages on the website they start a real spam attack.

Also, does your forum allow to edit posts afterwards? It's not uncommon for spambots to make innocuous posts on a forum and then months later edit them to contain spam. It's unlikely for your actual users to stumble upon these spam posts later, but search engines will find them. This is what spammers call "search engine optimization".

I've also seen bots which hide spam links really well. For example by hiding links in punctuation. That is easy to miss for moderators who don't look at the sourcecode of posts.

tl;dr: When someone makes a post like the one you described, delete it. Especially when it is posted in a thread where it is off-topic and when it is in a foreign language.

Improve this answer
2
  • Thanks for these hints. The tracing bullet theory seemed unlikely for me, because I couldn't see a real benefit: Instead of doing a greeting-post, waiting, scanning the site and then doing a spam post, they could just try to post the spam directly (and if it fails, who cares?) The posts by anonymous users afaik are not editable. The point with the hidden links does not apply to the recent example, but you're right: It's certainly worth to check the source code of these posts more closely!
    – Marco13
    Commented Sep 28, 2016 at 13:11
  • 1
    @Marco13 the point of the tracer bullet is that it might take them a few tries to get a post through, but as soon as spam is noticed they could get IP-blocked, cutting off future attempts. So first they figure out how to sneak their posts in, and then they deliver the spam payload.
    – Monica Cellio
    Commented Sep 29, 2016 at 18:21
4

I see another possibility next to the one in Philipp's answer.

There are still forums that allow clickable links as the name, and that itself is then filled with the spam URL.

If this is possible on your site: check the names.

If this is not possible on your site: what you see can be the result of the spam software trying to create such a spam link. The anchor text Will from Bosnia registers on your site, the underlying buycheapreplicawatcheshere dot com spam URL fails to register.

You should indeed delete them anyway. They are very likely spam attempts and if not, off-topic.

Improve this answer
1
  • Thanks for this hint. The names of anynomous users are not clickable, but indeed, it might be that a bot enters some link somewhere in the submission form, which does not appear in the final post.
    – Marco13
    Commented Sep 28, 2016 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.