Another spam recipe posted to a blog instead of being processed

Interesting stuff: http://pastebin.com/U7jv9jxS [hnn]

Ransom: the new spam?

So online extortion is a thing. And it seems that vigilante justice, the old-fashioned way, might be an answer. [hnn]

Excellent happy synthetic eyesight

So back in April (yeah, I'm still chewing through April's bookmarks, can you believe that?) I bookmarked Qbix, a new social platform attempt that ... doesn't seem to have done a lot since April. And I was going to mark it as a kind of interesting point, but got distracted by a comment spam on their blog.

Excellent happy synthetic eyesight with regard to details and can anticipate problems just before
they happen.

That's kind of poetic, and Googling it turns up a lot of similar variations. This kind of thing always draws me in, because there's a template at work here that could easily be reverse-engineered, allowing us to classify the link spam and identify specific actors.

I just love that kind of plan. I really ought to do something with it.

Machine learning for link spam

Double-whammy for tickling my fancy: a blow-by-blow account of applying machine learning to detection of link spam.

Webspam template

Some spammer mistakenly posted the template instead of the Webspam to a comment section - here's the gist!

Outgoing spam detection

Interesting perspective.

The Economics of Spam

Interesting.

Spam aping workflow

Here's an oddly evocative spam I got today (but without any attachment, rendering it moot):

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

Hello,

Please find enclosed a record of invoice that could not be processed. We would like to ask you to assist us in resolving the noted rejection reasons

Pretty fascinating.  Clearly a delivery mechanism for some sort of PDF exploit, but de-fanged along the way.

Why 419ers use such bad English

To filter out only the most gullible.  This is actually pretty cool!

Spam starting point

Forum spam. We loves it, preciouss.

Craigslist spam tactics

Nice analysis of the design of Craigslist spam - noting that it's difficult to see a true dividing line between aggressive marketing and outright spam.

Blog spam

Searched on "book hosting" - got this.  Fascinating.

Time for a link dump

I've been sick, and the interesting tabs are piling up in my browser.  The problem is that the browser in question is on my 7-year-old XP laptop, and frankly, its CPU fan is starting to bug me.  So before I go to bed, link dump time!

• jQuery file upload demo.  OK, I know, but I'm a sucker for this stuff.
• Zac Stewart weighs in with an interesting proposal to use the HTTP OPTIONS verb for API self-description.
• Mojolicious boilerplate.  You had me at "boilerplate".
• Building world-class ML systems, an article at the O'Reilly Radar that I haven't even had time to read.  By the way, the complaints about NLP systems usually failing when normal mortals try to use them (OK, maybe I'm slanting that a little in paraphrase) is because current NLP systems aren't actually intelligent, but people don't have the mental tools to understand that.
• wkhtmltopdf - heck of a name for a tool that uses WebKit to render an HTML page to PDF.
• Diagram.ly - I'm pretty sure I've linked them before.  But still.  Here they are again.
• First in a series listing the tools for modern Web development.
• Nice post mortem on a virus infiltration.  I'm a sucker for that stuff, too.
• My cousin Erin's old blog has a post on responsive prototyping that's pretty slick.
• (See how I name-dropped there, but only for the really hip?  That's just how I roll.)
• Clearly.pl, a programmable structured text editor in Javascript. [github]
• generic-ci, a generic continuous integration tool that doesn't pull in all of Java.
• Cheap hosting page.

Book: Machine Learning for Email

Another good one from O'Reilly. The ebook is only 15 bucks.

A whole spam site?

Google spam, I think, at thetechnologyreview.com - it looks like a blog, but the English ... isn't. It hits well on keywords, though. So is it written by bots, or by people who don't speak English?

Who knows?

"GET UPDATES ON LASTEST TECHNOLOGIES, ANDRIOS, IPHONE, LAPTOP & MUCH MORE…"

Update 2014-11-28: Ah, a shame. It's evaporated.

Website spam fighting

Another article:

• Rename default pages
• Set up honeypot fields (hidden fields on the form)
• Follow up on spammed companies
• Have human moderators and an educated forum community

I gotta get back into this.

CRM114

Jesus H. Tap-Dancing Christ, I have seen the light. And it is CRM114.

A little background here. Back in 1999, a friend of mine said, "Hey, there's no free spam filtering forwarder in the world. You should write one, and then we'll figure out how to make money with it." So I did. Despammed.com was born. For the next five years or so, I learned a whole lot about how not to administer the firehose that is email. Due to lack of attention, the server crashed and burned and much of the code was lost (not the filter!) and the service, although its zombie is still on the Net, never really recovered. Because I didn't really care any more (we never had figured out how to make money with it).

In early 2007, Web spam was getting to be a hassle on a forum I had for my then-Web comic (by that time, it was already essentially in permanent hiatus, but a few friends still hung out on the forum). Xrumer had been released in November of 2006. I wrote a despammer for my forum and it worked for a while, but eventually I was forced to close the forum entirely. The release of that seems to have been on February 4, 2007.

In May of the same year, I refined some of the techniques I'd been working with, and the result was the modbot in Perl, a modular framework for applying various tests to determine the spam nature of a given post. It worked kinda well, but I couldn't drum up much interest in the wider world, and it died mostly a-borning.

OK. So that's my history in despamming. Now along comes something I never heard of: CRM114, which is a programming language invented specifically for expressing spam filters. And I'm looking at it, and I love it so much. Seriously. Also, here's a paper about it. Here's some publications by its perpetrator, William S. Yerazunis, who now works for Mitsubishi Electric and comes across to me as a really funny guy who would doubtlessly be a hoot to have a good supper with. Also, my envy for him burns with the heat of a thousand suns, because he basically seems to do all the stuff I really wish I had time to do.

So anyway. I am going to learn the shit out of CRM114.

Spambot combat

Here's an article with some very nice techniques for building more spamproof submission forms. Tl;dr:

• Timestamp: don't allow a long period between reading and posting. (I had mixed success with this way back when.)
• Hash: check the IP, timestamp, post # - prevents playback attacks.
• Randomized field names.
• Honeypot fields: invisible (not hidden) fields that, if filled in, are a spam indicator.

The author of the post uses these and only these to block spam - no content-based filters at all. That's cool.

As you know, Bob, I have long wanted to produce a workflow system of sorts that would include spam content filters; form generation is something I hadn't even considered - but it's a great idea. So ... keep this in mind.

SURBL

Interesting: a database of URLs/domains that have been spammed.