Blog Spam

One of the weirder aspects of writing this blog is that I get regular spam comments. The comments usually have just a few words, along of the lines of “great post, this will really help me with my essay,” along with a link to some commercial web site. At the moment I’m running about 40 of these per day. I simply delete them all, which fortunately is fast and easy. I expect it will be even easier when I get around to upgrading to the newer version of WordPress.

I can see two possible motivations for this spam. The first is that it is aimed at Google’s well known PageRank algorithm. Nobody reading some random blog is likely to be in need of cheap airline tickets or whatever they are selling (here I judge by the name of the link). And given the rate at which these arrive, any blog which doesn’t delete the spam comments will simply be inundated with them, so no person would ever read the comments anyhow. But if these links appear on a bunch of random sites, then it seems at least possible that Google’s search engine would misjudge the link target as a popular and important web site. The thing is, Google isn’t really that dumb. The spam comments are so regular that even a simple computer program could detect a spam blog. So it’s hard to believe that these spam comments really increase the rating of the site in a search engine. If anything I would think that they would decrease it. (I should say that although I work at Google, I do not work on search, and I don’t know any details about the actual algorithms which are used. In this paragraph, I am simply guessing as to how it probably works.)

The second motivation I can see is that the links might be traps. If somebody running an unpatched Internet Explorer clicks on the link, they might get infected and have their computer incorporated into a botnet. That would seem like a good reason to put the links out there. Again, though, no human would be fooled by these links. I know that a lot of people don’t really understand how bad Microsoft’s browser security model is. Still, the links look like obvious spam; why would anybody click on them?

I haven’t been able to think of any other reasons, and these reasons are very weak. So why do the spammers bother? Why do they bother putting comments on my blog, when none of the comments ever show up on the actual web site? The comments are obviously created by a computer program, so they are cheap. Is it just a case of getting a benefit from one comment in ten million, so you might as well try?

I haven’t bothered to check, but I hope that organizations like Project Honeypot run some simple blogs to collect comment spam. That would help them map botnets. Unfortunately we then need some approach to actually fixing botnets. As far as I know, we don’t have one.