Portrait of a Comment Spammer

The Register interviews one of the people responsible for posting spam in blog comments:

Sam's code gets hundreds of open proxies to obediently spam blogs and other sites with the messages he wants posted. They usually target comments to old posts, so they won't show up to people reading the latest ones, though search engine spiders will spot them and index them. And here's the surprising thing: link spamming is not outsourced. These people do it on their own behalf. (Does this mean it's an immature business? Reg readers please advise.)

Here's why. When Sam spams tons of blogs and sites with links to his sites - which are affiliates of bigger PPC sites - people see the links and, seeking some porn, pills or casino action, click through to his site, and from there to the parent site, which pays Sam for each person landing there. The PPC sites can see revenues of £100,000 to £200,000 per month, says Sam. He gets a slice of that - and he wants it to stay that way.

Of course, now it's not just comments that are targeted -- it's trackbacks, too. (Incidentally, I don't recall ever getting any trackback spam attempts until today. MT-Blacklist blocked over 200 of them today alone.)

Will the initiative by Google, Yahoo and MSN, to honour "don't follow" links defeat Sam and his ilk? "I don't think it'll have much effect in the short, medium or long term. The search engines caused the problem" - we didn't quite follow this bit of logic, but Sam continued - "and they're doing this to placate the community. It won't work because most blogs and forms are set up with the best intentions, but when people find hard graft has to go into it they're left to rot. To use this, they'll all have to be updated. The majority won't be. And there'll just be trackback spamming."

By this Sam means spammers setting up their own blogs, and referencing posts on zillions of blogs, which will then incestuously point back to the spammer, whose profile is thus raised.

Is there anything that can stop the spammers (or at least make their work harder)?

So what does put a link spammer off? It's those trusty friends, captchas - test humans are meant to be able to do but computers can't, like reading distorted images of letters. "Even user authentication can be automated." (Unix's curl command is so wonderfully flexible.)

"The hardest form to spam is that which requires manual authentication such as captchas. Or those where you have to reply to an email, click on a link in it; though that can be automated too. Those where you have to register and click on links, they're hard as well. And if you change the folder names where things usually reside, that's a challenge, because you just gather lists of installations' folder names."

This guy makes a lot of money doing this and thinks it's fun. It's perfectly legal and he has no moral qualms about using what amounts to other people's property to advertise junk.

(Via Bene Diction.)