Tom Lee writes at Manifest Destiny about his discovery that spammers were abusing a full-text RSS tool he developed.

The self-described black-hat search engine optimization crowd — the folks who assemble sites peppered with ads that are designed to attract search engine traffic, aka “link farms” — had been using my script to steal other people’s content and republish it on their own sites.

Spammers call those link farms “autoblogs”. They’re a popular fad among black-hat SEO consultants (which is what spammers generally prefer to call themselves). His description is correct: they use automated tools to copy material without permission and re-publish it on fake blogs covered with ads. Typically they also send high volumes of pingback or trackback notifications to try to trick naïve bloggers into linking to them (thus boosting the spammers’ search engine rankings – often at the expense of the original authors of the stolen material). They rip off both the bloggers whose material they’ve stolen, and the advertisers who are paying for worthless ads run on bogus sites.

It’s a pattern of behaviour we’re all too familiar with at Akismet.com. Spammers take advantage of trusting (and trustworthy) bloggers, web sites and online services. And it’s the innocent operators of those services who, ultimately, are harmed the most.

Tom’s experience demonstrates an unfortunate modern reality: that spammers will take advantage of trust and openness. If you own any web site that allows users to consume resources – that is, any web site that allows users to perform an action – you need to monitor it for signs of abuse. An unsupervised or abandoned web site is a spammer’s playground.

If you’re using the test revision of the WordPress Akismet plugin and seeing messages about connectivity problems, don’t be too alarmed.

Akismet is up. Our servers are working. Our network is fine. We are not experiencing any service difficulties.

We’re still sorting through the reports to find out why people are seeing error messages.

In most cases, the error messages are correctly reporting that a firewall is preventing connections from reaching Akismet.com. This problem is caused by the web host, not Akismet, and only the web host can fix it.

In some cases we’re seeing reports that may indicate spurious errors. This may be a bug in the diagnostic code, a conflict with another plugin, or an intermittent network issue at the web host – we’re still investigating.

Update: We’ve found a timing bug in the diagnostic code that can cause the Akismet plugin to report an error when in fact everything is working normally. The bug affects the diagnostic feature only; spam checking still works as normal. Version 2.2.5 of the plugin will be released shortly with a fix. In the meantime, clicking the “Check network status” button on the Akismet Configuration tab will normally remove the error message.

Update: Akismet 2.2.5 is released with a fix for the timing bug.

The issue is not a connectivity problem, but a spurious error message that is produced when connections are actually working fine.

Remember way back when you first got interested in web design? Seems like an eternity ago in web years when I made my first clumsy web sites. Maybe you got started making home pages for friends or a local club. Maybe you helped some people get hosting accounts, set up a quick web site with a forum and a blog and a shopping cart. Ah, those were the days.

It’s easy to forget that many of those old web sites are still online – abandoned, un-maintained, and insecure. Many of them date from the days before web spam was common, so they don’t include any spam protection.

Spammers know this. And they love it. Here’s why:

That’s a real screen capture from a forum that was once a real community – but has since been forgotten by its unsuspecting owner.

This is an all-too-common occurrence in recent months. In order to try to avoid being caught, spammers are hosting their advertisements for porn and pills on these old abandoned forums, which typically have an open automated registration system that lets anyone create an account without the owner’s knowledge or intervention. Then they send thousands of spam messages in blog comments and emails, with a link to those abandoned forums.

In other words: right now, someone might be sending offensive spam to thousands of blogs with a link to your web site. Like this example, taken from a comment spam (we’ve censored the real domain name for obvious reasons):

<a href="http://&#91;REDACTED&#93;.com/forum/showthread.php?p=200789" rel="nofollow">Amateur with natural big boob</a>
-Cori the natural milf shows off her big juicy tits 
<a href="http://&#91;REDACTED&#93;.com/forum/showthread.php?p=200794" rel="nofollow">Free big tit blonde movie</a>
-Samantha babe plays with big boobs and poses in bed 
<a href="http://&#91;REDACTED&#93;.com/forum/showthread.php?p=200805" rel="nofollow">Big tit porn star movie</a>

Sadly that’s some of the less offensive spam – it took a while to find an example we could safely publish. Akismet will almost always catch these spams of course, but not everyone uses Akismet.

This technique has been around for a while, but in recent weeks we’ve seen a massive increase in the sheer number of un-maintained sites exploited in this way. Forums are the most common victims, but we’ve also seen forgotten photo galleries, blogs and social apps exploited in the same way.

Left unchecked, the damage to your reputation could be substantial – not to mention what it could do to your search engine positioning. So we’re advising everyone to please check on your old web sites.

If you have ever set up a web site for someone — or installed a test copy of a forum or web application on your own web site, even one that was never publicly announced — now would be a great time to check that it hasn’t been exploited by spammers. If it’s still clean but unneeded, consider removing it or disabling the account signup process as a preventative measure.

If you’d like to keep it online, make sure you install a spam filter like Akismet – there are Akismet plugins available for vBulletin, phpBB and most other popular web forums.

Those who like to live on the bleeding edge might like to download and test the latest revision of the Akismet WordPress plugin from Subversion:

http://plugins.svn.wordpress.org/akismet/trunk

If you don’t know what Subversion is or how to use it, I’d suggest waiting for the next official Akismet release, which won’t be far away.

The new revision includes a new diagnostic feature on the Akismet Configuration tab that’s intended to address a problem with some web hosts.

We’ve known for a while that some web hosts and servers have firewall rules that block outgoing connections — including connections to the akismet.com API servers, which are necessary for the Akismet plugin to work. Usually the host administrators will add some firewall rules to permit the Akismet plugin to connect to akismet.com. But recently we’ve discovered that some hosts have created incomplete firewall rules, with the result that some Akismet connections succeed, but some fail. This caused Akismet to seem like it was working, when in fact only some spam was checked, and only some reports ever made it back to Akismet.com.

The problem is caused by the host’s firewall rules – it’s not something that Akismet can fix. We can detect the problem, however, which is exactly what the new revision does.

The new feature adds a Server Connectivity section to the Akismet Configuration tab. The new section will check for any problems connecting to any Akismet servers, including the partial firewall problem, and recommend a course of action if there is an issue.

There’s more code in the new revision than we would typically add in an Akismet update, so testing and feedback are welcome.
Continue reading →

The FTC has launched legal action against a Californian web hosting service it says is responsible for botnets, malware, credit card theft and of course spam. The provider has been disconnected and its operators now face a lawsuit.

The FTC alleges that Pricewert/3FN operates as a “‘rogue’ or ‘black hat’ Internet service provider that recruits, knowingly hosts, and actively participates in the distribution of illegal, malicious, and harmful content,” including botnet control servers, child pornography and rogue antivirus products. 3FN also operates by the names APS Telecom and APX Telecom.

The provider is known as a frequent host of “scraper” or autoblog sites — fake blogs that re-publish unauthorized copies of content taken from other blogs, often sending spam pingbacks and trackbacks in the process.

Our sources indicate the network also provided services to several of the major forum and comment spammers. In particular, web sites owned by the developers of several spambot programs have been shut down (though we expect they will resurface elsewhere before long).

Of course if you’re using Akismet you won’t notice much of a difference: Akismet has long been highly effective at catching spam produced by their spambots and autoblogs.

Our stats suggest a significant and immediate drop in overall spam levels coinciding with the FTC’s action – on the order of about a 20% reduction (in spam that was or would be successfully caught by Akismet).