azurelunatic: A glittery black pin badge with a blue holographic star in the middle. (Default)
[personal profile] azurelunatic
There's a new variation on one of the ever-popular testing campaigns.

(A "testing campaign" is where the spammer pokes a location that it might like to actively spam in the future, to see how easy it is to leave comments there, how long the comments last, and whether they will show up in search engines, and possibly other things. These campaigns don't actually leave spam links, but they're still run by spammers, get in people's way, and should be treated the same as spam with actual links.)

This particular spam campaign features a subject line that looks like YouTube sneezed, and then a financially-related comment. It probably makes no sense in context with the entry or comment that it's in reply to.

Other similar campaigns:
Keysmash subject, vague compliment
Keysmash subject, vague compliment (often self-deprecating) with (at least) one misspelled word (there may be other misspelled words in the comment, but those are usually in line with common netspeak; the misspelled word that identifies this campaign uses all the correct letters, but out of order)

Be suspicious of any comment that includes a random-looking keysmash, because that keysmash is probably unique to that one piece of spam, and the spammer will go looking for it later to see if what it did that time got through and made it stay in place.
azurelunatic: Azz: Spamwhacker, with a white dreamsheep on a stalk growing up out of the grass like a flower (spamwhacker)
[personal profile] azurelunatic
Hi, Dreamwidth!

Since I saw a couple people wondering, I wanted to confirm that there is a known spam campaign that leaves anonymous comments with a subject that looks like a cat walked over the keyboard while a second cat was repeatedly batting the caps lock key off and on, with the body containing a vague compliment with at least one word where the letters have been artfluly rearranged.

The keysmash subject is likely a unique identifier, so the spammer can tell which specific comment got through when it checks or searches later.

Why the vague compliments? Well, a compliment may well fit in to the existing conversation, and may be a way of attempting to build up a reputation as harmless/helpful for that IP address.

Why no spammy links? This may be merely a test campaign, to see how soft a target we are. Or they may just be attempting to build up good reputation so that when they do make with the links, they won't immediately get kicked off the site. Or they may not have anyone paying them to spam right now. But the IP that's emitting gibberish and compliments today is surely tomorrow's viagra-and-handbags vendor.


If you find that you've been getting keysmash-and-misspelled-compliments, please do go ahead and delete them as spam if you have the time and energy. A lot of them, even old ones, are from unique IP addresses, so you may have been the only one hit by that particular specific source.

If you have questions about other comments that don't fit this pattern, you can ask: here, in Support, in the latest [site community profile] dw_news entry, and probably some other places. There are usually a lot of helpful people around who either know off the tops of their heads, or know where to find a spamwhacker.