Less Email Spam, More Blog Comments Spam. Spammers’ Revenge?

I may be paranoid or something but I have a feeling that there is something very suspicious going on in the spam empire. You may remember that this week we have discussed news about a hosting company that powered numerous spammers and scammers disconnected from the internet. What’s more, we were told that we should see the number of junk letters in our email inboxes dropped by at least two thirds as a result - at least until the spammers find new servers to run their bots.

Honestly, it was incredibly hard to believe that only one hosting provider could give enough place and facilities for this significant portion of the worldwide spam - not until I saw 6 spam emails in my personal Gmail account today (where I usually get 40-50 daily) and only 30 since yesterday in my business one which usually gets at least 200 spam emails on a daily basis. Ok, it was a nice surprise and it is a pleasure not to waste time on extracting valid emails from the spam folder - even if it only lasts for a week maybe.

But now it looks like I have another reason to worry - and that one looks like it is much larger-scaled and is very difficult to control, at least much more difficult than looking through a hundred or two of spam emails daily. This time spammers seem to have turned to blog comments - and I feel like it is not a positive change at all - at least to bloggers.

The reason for my suspicion is pretty simple as I am seeing incredible increase in the number of spam comments since yesterday. Usually Akismet filters out about 200-300 spam comments for Profy per day and I have a habit of checking all of them out to make sure there are no legitimate comments deleted by me by accident. Yesterday in the morning I completed the usual procedure and left the spam folder empty only to see over 300 new spam comments about an hour later. Just imagine my surprise knowing that this is what I was supposed to see no earlier than this morning (especially without any significant surges in traffic that could lure more spammers in). I felt worried but decided to ignore it as I thought it was some short-time attack (maybe directed at Profy only) that would soon be over. I am not sure if a whole day is still too soon for it to stop but this morning I deleted over 3 thousand spam comments and I already see more than 400 new ones after I started writing this post.

I guess it is understandable that I started to worry and decided to see if there was any discussion of the issue in the blogosphere or on Twitter. And of course there was a discussion - and it actually started earlier this week so now I am probably seeing the consequences of the problem discussed over the week. The thing is that some time around Tuesday multiple bloggers started to notice unusual comments that Akismet did not filter out as spam so they appeared on their blogs as legitimate comments. These comments represent randomly generated lines of symbols and we have received such comments on Profy more or less frequently for some time now as well. For example, back in March we experienced a serious issue with the number of such comments that always made it to Profy and I constantly tried to teach Akismet those were spam - but in vain. Some time later these comments stopped without any apparent reason and I did not see those in spam filtered out by Akismet either so they were probably simply not sent to Profy any more.

This week many bloggers reported experiencing this problem with all of them mentioning IP addresses used to submit such spam comments originating in Amsterdam. The conclusion of this week’s discussion was that we are seeing spammers testing some new bot (or collecting all the blogs that are vulnerable to spam) and we should expect a huge attack by spammers soon. So I have a feeling that this is exactly what we are seeing now. Besides, it certainly looks like I am not the only one experiencing this problem as my quick Twitter research shows:

I am no internet security expert to try and suspect that these two events - McColo spam hoster shut down and ten-fold increase in the number of spam comments this blog receives along with comments from other bloggers on Twitter - are actually related. But I do think there is certain possibility of spammers trying to compensate their loss of one network by quickly introducing a replacement to address another medium. Of course it is hard to reach any definitive conclusion until security experts have their say but I’d sure want the specialists to look into this issue and at least offer some explanation.

I have also asked Akismet as the expert in spam comments for a comment about this and will update this post if I receive some additional information from them. For now there is nothing about the issue on the Akismet blog or on the Twitter account that seems to belong to them (even though this account is not active at all). We’ll see how the situation develops from now on.

Image credit.