WordPress Comment Spam
The plague of all blogs is spam, mainly comment spam, by sheer numerical superiority.
Q. Why Do They Do It?
A. As a minimum, they do it to open a back-door into your blog that allows the perpetrator to place reverse linkages to another website to increase that website’s visibility in search engine results (so called “Search Engine Optimisation” – SEO ). This back-linkage they use to increase website search hits, which they can charge an ignorant website beginner big money for.
At the worst, the culprit would gain full access to the blog allowing free posting and deletions or even the complete removal of your website content.
Today’s Example
Today, I got a comment that made me check further as notionally, it looked okay-ish. These are the details (click image for full-size view of the comment as it appears in the WordPress admin section):
The Jacksonville lawyer is in Florida and has this website; https://www.divorceyes.com/index.html, and the actual comment is pretty kosher, although brief, saying;
Strangely you have made an awesome post and i appreciate your work and keep it up. Thanks for sharing this with us.
This is all very nice, but check out the IP address….
WHOIS 113.203.135.140
By checking the WHOIS for this, we see that the IP Address for this supposedly reputable Florida lawyer (Divorce Yes) is in Karachi, Pakistan! Well are they? My guess, given the cheap web costs in the USA, is that Divorce Yes is in the US and that they wouldn’t for an instant even consider anywhere else!
And so it is! The actual WHOIS for Divorce Yes is in Florida! (The actual WHOIS for the web-hosting, fortehosting.com is in Illinois). The registrant’s name (Miller) also agrees with the Divorce Yes’s contact details here, but note; the email address in the comment, divorceyes@ymail.com, is not the same as the email address on the contact page, which is sdm@divorceyes.com.
Registrant:
jeff miller
1019 grand court
highland beach, Florida 33487
United States
Registered through: GoDaddy.com, Inc. https://uk.godaddy.com/)
Domain Name: DIVORCEYES.COM
Created on: 07-Jun-05
Expires on: 07-Jun-16
Last Updated on: 17-Feb-07
Administrative Contact:
miller, jeff bitethehook@aol.com
1019 grand court
highland beach, Florida 33487
United States
(561) 445-6962 Fax — (561) 347-7588
Technical Contact:
miller, jeff bitethehook@aol.com
1019 grand court
highland beach, Florida 33487
United States
(561) 445-6962 Fax — (561) 347-7588
Domain servers in listed order:
NS1.FORTEHOSTING.COM
NS2.FORTEHOSTING.COM
Conclusion
There isn’t a conclusion really. This is just an example of the way that text harvesting is being used to make seemingly intelligent comments slip past the comment filters on a WordPress blog.
As many of these filters rely on an IP address, if the webmaster lets a dodgy IP address through just once then it’ll be marked as “good” by the filters which will then allow the spammer to post even more comments, all for the various nefarious reasons that I mentioned first.
This is why I use a plugin like WP-SpamFree, and using it I can block all incoming pings from a given IP address, in this case, 113.203.135.140!
For interest, I’ve edited out the back-link from the spam comment above and you can find it on this post, Pacific Webworks, Lawyers and Social Networking, here.
Alternative Conclusion
This isn’t a conclusion again, but my examination of alternative possibilities, but note the following:
- The Divorce Yes website is made and SEO’d by http://enettechnologies.com/.
- WordPress is used on the website.
- Many WordPress plugins exist to “improve” the SEO of a website. (I use some!)
- Some do it by ensuring meta and other data is added if it’s missing.
- Others have sprung up over the last few years that “intelligently” link to other websites…. they harvest websites for text and linkages for later use, much like email spammers scan websites for email addresses to spam. [n.b. I use PHPEnkoder from Michael Greenberg to hide email addresses on this site from email address harvesters.]
It could be, although I cannot prove or disprove it, but because some of this spam I receive is now pretty readable as with this one above, that plugins are being used for much of the hits I get. This comment could be such an example, or the law website name is being used textually as a smokescreen for the Pakistani spammer. I see lots of adverts along these lines that couldn’t possibly rely on manual human link placements for their effectiveness….
I’d be interested to hear from Miller Law or their website designer on this one. It’s not the first time that I’ve had reputable businesses appear on my website like this and I’d like to know what it appears like at their end, if at all. It does make me wonder if this very website is being used to cloak spam at other websites in the same manner.
This is why I’ve left all URL back-links to the parties in place so that they’ll see them in their logs.
Leave a Reply
You must be logged in to post a comment.