That’s one milestone passed on the blogging road: I just blogged for the 1000th consecutive day. Started on August 2nd, 2003, and haven’t missed a day since. Sometimes it’s very hard to come up with something that feels worth writing about. Sometimes there are several things, and I blog about them all or choose which ones seem best. I try to make each day’s post more than just a quote or a one-line reference. Sometimes, as you may have noticed, I get carried away and write if not a book, then a novella perhaps, or at least it feels like that.

So the question is, how long can I keep this up? I mean, it’s become a real thing, now. I’ll get back to you the next time a significant milestone comes along, I guess.

Just as a quick example of spam proliferation–I have gotten spam on several occasions since late last year with a particular keyword in it. This happens fairly often, as spammers want some unique identifier they can use via Google to see which of their spam droppings got published, and how many Google has recognized. The one that I am speaking of includes the words “compliment whose” and then the word “wondered.” In the spam, those three words appear connected as one long word; I separated them here so they could not be found by the spammers via a Google search.

My point, however, is that if you do a Google search on that text string, you’d find Google reporting “about 130,000” hits. Considering that a great many of the spams sent get filtered by anti-spam software, including spam filters, registration, and captchas, then consider all of those that Google did not find, and you can estimate that just this one version of spam has been sent easily several hundred thousand times, probably millions–and it is very likely that this is just one of many different versions or types sent out by the spammer responsible. You will also find that blog or even newspaper posts which contain the keyword often have dozens if not hundreds of spam messages accumulated in the comments–this being the reason why spammers continue to spam so much.

Nothing huge or earth-shattering about this. I simply wanted to point out a small example of how outrageously prolific spammers can be, and some of the methods they use to check on their success. I’m still waiting for someone to institute a system that will do something to at least take the edge off of these people who take a valuable system of worldwide communications and use it as their own personal toilet.

The “Itsok” spammer is back. Though I have blocked the string “itsok,” the spammer seems to have caught on to that, and has introduced variations. I am trying to block them, but just to be safe, more than one URL per comment will trip the automatic comment block.

Son of a…

I check my stats after leaving them alone for 3-4 days, and I get a shock. About 30,000 more hits than could be expected. Roughly 12,000 more unique-IP visitors than normal. A one-day high on Thursday of 7500 visitors, 5500 on Friday, 4000 on Wednesday, when the recent average has been hanging around 1800. Huge spike in visitors.

At first, I think this may be because I got a link in from somewhere, some big-traffic site saw mine, put a link out, and thousands of people come to check out what I’ve been saying. But when I check my referrers and page stats, there’s not a single blip. Nothing to account for it all. And then I figure it out. I check the cellar of my referral list, and there they are. A massive hotlinking event.

What is a hotlink, you ask?

A hotlink is when one web site hijacks an image from another web site. You see an image on web site “A,” you think it exists there. Usually it does. But with hotlinking, the image is really from web site “B,” a different site. The owner of web site A simply told your browser to go to site B, get the image, and display it as part of web site A. Web site B hosts the image, owns it, pays for it–but web site A, the thief, gets the props for displaying it, and no one ever hears of the site that actually has the image. It’s like someone taking credit for something you did. You did the work, you paid the price, but someone else reaps the benefit and suppresses your name.

Allow me to demonstrate. Look at the “Links” button at right. The image appears here on my site, blogd.com, right? Ha! Fooled you! It’s not on blogd.com at all! It’s on one of my other sites (www.teach-japan.com, a site forever under construction). If you looked at the coding for this blog page, you’d see that the image address is really at the other site. But by a simple web page command, I was able to integrate the image into this web page, so it seamlessly appears to be located here. My other site gets no credit, no one knows it came from there.

Well, what’s wrong with that, you ask? Plenty. You see, hosting a web site costs money. You pay for disk space. You also pay for “traffic,” also called “bandwidth,” meaning that every time you visit my site and see the images, they are being sent (“downloaded”) to your computer. If the image is 100 KB in size, then I get docked 100 KB in traffic by the people who host my site. Every month, I pay that web host a fee for disk space and traffic.

When someone hotlinks to one of my images, it appears on their web site, but I’m paying for the storage and transport of that image. It’s as if someone not only steals a painting from your house, but they also charge you for the gas used by the getaway car and the fees for the storage locker to keep the stuff they stole from you. It’s more than that, since the image is repeatedly stolen by each and every visitor to their web site. If they hotlink to an image 100 KB in size, and 1000 people visit their page, then I get docked for 100 Megabytes of traffic fees. Now, I pay a flat fee for a lot of traffic, but still, it’s my traffic.

Hotlinking is considered even more of a no-no because the hotlinker appears to be taking credit for the image, and the person who is paying for it remains uncredited, not getting so much as a link-through. If they had made the image into a link and I actually got thousands of new visitors to my site, that’d be OK, because I want new visitors. But they didn’t–they hotlinked without credit, so they got the goods, and I got shafted.

Usually, when people hotlink from me, it’s people at places like Xanga or MySpace (where people set up “free” sites), or people on discussion forums who want to show images but aren’t allowed to upload them to the forum space. Usually I find out when an image gets downloaded from my site hundred of times. I find out where it’s going, then I either allow it, or I swap out the image.

But this time, it was a commercial site, one that sells advertising. A movie rumor site called “Ain’t It Cool.” And they hit me for 30,000 image transfers, which cost me about 1.5 GB in traffic before I caught it.

Well, I showed them. One of the dangers of hotlinking is that they don’t control the image! I do! So I changed it. Instead of the image they wanted to have on their site, I replaced it with a plain-text image ad for my site! The image is this:

The beauty of it is, they probably won’t even see it until someone points it out to them. Their own browsers already have the original image in the browser cache, and so the new image only shows up when new people come to visit. See if you can spot it, the page is located here. As long as it’s up, I get free advertising on a hot web site! Whee!

UPDATE: They yanked the image. Ungrateful wankers. They stole 1.5 GB of traffic from me, then erased my ad within just a few days. I’d like to say, “that’ll teach ’em,” but from the comments on this post, I gather these guys are simply contemptible lowlifes, and they’ll keep on doing it. But not to me, if I can help it. I’ll have to be more vigilant about watching the stats for hotlinkers.

Alas, I come too late. The mass of the hotlinking wave is past, 12,000 people saw the original image, and I might only catch a few thousand (and probably few of them will actually come and see my site). But still, it’s fun to punk someone who’s filching from me.

I recently commented on a spam deluge that hit my site, from a spammer who used a non-filterable style. All the spams had 3-4 links each to non-spam web sites (news, educational, movie web sites), and all had different fake IP addresses, emails, names, and messages. It seemed there was no way to filter the things. None got through and appeared on my site, mind you–but enough got through to moderation that I had to lower my limit of links allowable per comment as the only way I could figure to block the flood from littering my moderation queue. This kind of spam deluge happens every so often, and is probably a test by spammers to see whose blogs are most vulnerable to attack.

In my recent post, I noted that there was no way to filter the things outside of a straight URL count. Only after the flood ended a few days ago did I realize that there actually was a filterable, but I had missed it. It was subtle, and was undoubtedly the manner in which the spammer could search for which blogs fell prey to his little test. It was a bogus HTML attribute. Usually, a link command in HTML goes by the simple form: <A HREF=”address“>. “A” is the link command, and “HREF” introduces the address of the web page being linked to. Sometimes there’s a “TARGET” attribute which directs where the link will open into, as in a new window.

Well, this spammer sneaked an extra tag into one, and only one, of the the links in each spam; the tag was REL=”itsok”. The “REL” tag is supposed to describe the relationship of the link to the page. Some theorized that the “itsok” spam was intended to foul up anti-spam measures. The “REL” attribute in links can hold the value “nofollow,” which causes Google and other search engines to fail to recognize the link and therefore deny the spammer “Google Juice.” The introduction of a fake “rel” attribute might be intended to break the “nofollow” attribute. However, this spam flood only links to legitimate sites, not spam sites, so there’s no point in breaking the “nofollow”–unless, again, it is a test.

But others theorize that this kind of deluge is an attempt to corrupt the spam blacklists. When spam hits blogs, the URLs in the spam get reported to central blacklists that many people draw upon. The theory here is that if enough legitimate sites get entered into the public blacklists, then they will become useless as real sites will be blocked along with the spam sites.

When I did a search on Google Blog Search, I found three other bloggers who had found “itsok” attribute in a November-December spate of attacks. Others have found it as well. A regular Google search will find people talking about the attribute, but it will also reveal all the sites that did not block the spam–which is what the spammer undoubtedly used to beef up their spam lists. Add the word “spam” to the search and you’ll get a more pure list of people talking about the itsok spam.

I originally missed this whole “itsok” thing because my email program (where I see the spam being reported) translates the link code into an actual link, hiding the code. In the future, I’ll be sure to examine the spam much more carefully. Had I known, I could have just added “itsok” to my blacklist and avoided restricting links in comments. Oh well, live and learn.

For what must be the third or fourth time, this site is being barraged by tons of spam, about 30-50 a day all this week, in the form of fake glowing reviews of the site with three or more links to generic news, movie, and educational web sites that are of course unconnected to the spammer. These weird spam messages are of no use to the spammer, as they don’t link back to the spammer’s site–they just link to news sites like The Dallas News, The Globe and Mail, the BBC, to web sites for major movie releases, or for universities. So you’ve got to wonder what the spammer is up to. They get nothing from it–with the possible exception of massively annoying the blogger. I suppose it could be a form of test to see what kind of spam will get through the filters–generate huge amounts of spam and then check to see if any of it sticks. Stupid, but then it’s an automated program and likely costs the spammer next to nothing.

The spam is also hard on unprotected bloggers, because it can’t be easily filtered. Each email has a different (faked) IP address, a different (fake) email address, a differently-worded message, and different links to different legitimate sites. Nothing for some filters to grab onto. But not a problem here–I use SpamLookup, which has a great deal of flexibility in blocking blog comments that fit a number of different profiles. In this case, I adjusted the number of allowable links down to two per comment (it had been set at 3, which is why I noticed the spam attack in the first place). Presto, all the spam is blocked and I don’t even see it. In a week, I’ll check the spam logs to see if it’s still coming in, and if it has stopped, I’ll reset the filters to the higher limit in consideration of my guests.

If you use a Moveable Type blog, use SpamLookup. A very nice tool. I still use MT-Blacklist–but will probably upgrade to MT 3.2 soon, which Jay Allen claims will do a far better job of eliminating comment and trackback spam.

In just one day, I’ve gotten about 1500 hits via Google from one source which seems to be carrying out robotic searches. This is not just starting now, I’ve noticed it for the past few days, but it really stands out in my stats, in the search engine details, since the clean slate of March 1st has zeroed all the figures.

The searches seem to be carried out using Google as a vehicle and seem to target Movable Type blogs. The copious searches all have the same structure, looking for web pages which include a Movable Type archive address structure like this:

inurl:”archives/001026.html”

Just change the number before the “.html” extension to include any possible number between 000100 and 001700, and you’ve got an idea of the massive barrage of auto-generated searches that get carried out (the 1700 limit is due to my blog having roughly that number of posts–the searches must certainly exceed that number elsewhere). The robot software then apparently follows each of the links given by Google which results in a referral hit on my site–and, I suspect, many, many others. Moreover, each search results in up to 20 hits for any one archive page. It’s as if someone is using Google as a tool in a bizarre cataloging of Movable Type blogs.

Anyone else out there notice this?

The searches and hits, by the way, are all coming from the same base IP address within an eleven-number range, specifically 85.255.113.179 ~ 85.255.113.189.

Update: I’m not the only one, as I expected. Here’s a guy who linked to this post and is having the identical problem. He’s done better than I have, though, and identified the IP address block as being from the Ukraine.

By the way, I reached 900 days of uninterrupted blogging on Wednesday. Also, a week or so ago, I exceeded 1600 total posts on the blog. There have been more than 3750 comments–and that does not include any spam. In the first 19 days of this month, there were 16,000 visits via search engines alone, and total daily readership averages at 1700 (including the post-New Year’s lull). Total monthly readership has been in excess of 30,000 unique visitors after taking spam into account. Totally not what I expected when I started this thing almost three years ago.

The title here is a bit of a defiant chant more than a Monty Python bit. As I may have mentioned before, spammers seem to get a perverted kick out of making blog posts which talk about spam a specific target of their spam-spew. They deliberately target any entries on spam, apparently using the word “spam” as a target text string. Well, spam them. Spam them all to hell. I can rename categories and individual pages faster than their spambots can catch on, and so their autospam programs wind up sending the spammy spam to non-existent addresses, which has resulted in hundreds of 404-page hits on my spam-free site in less than half a day. Spam!

They are currently in their now-traditional beginning-of-the-month spamfest, trying to rack up as many hits as they can so they can get to the top of the top-referrer lists. Of course, they’re idiots because nobody has top-referrer lists any more–not that such a fact bothers them much. Strange that they have ramped up their referral spam, and their assaults via blog comment spam and trackback spam have waned, considering that more bloggers allow the latter types of spam to go unchecked, and the former type probably gets them little or nothing. It’s almost as if they’ve stopped caring about the efficiency of their spam, and are now just using it, as much as for anything else, to vandalize sites which call them on their bullshit.

One thing I refuse to be is intimidated by these clowns. I’ll continue to chronicle anything and everything I can on the subject, and continue to block their garbage with 100% efficiency. That’s not a New Year’s resolution, it’s simply a way of life for a serious blogger nowadays. So spam away, Spamholes.

And for everyone else, a Happy New Year!

In this day when there are numerous free photo hosting services, I’m still getting besieged by hotlinkers. First, let me explain what “hotlinking” is.

When you own a web site, you pay a monthly fee to a “web host,” who has banks of computers with high-speed, 24/7 Internet connections and technicians to take care of them. They give you disk space, and you use it to host your web site. That means you put all your web pages (“html” files) and images, and whatever else, in that disk space. You are also allotted a certain amount of “bandwidth” or “traffic,” meaning that you have limits on how much data you send and receive. As a result, data coming and going from your web site has a price tag–it costs you money.

Now someone else comes along, usually someone who has a blog or other kind of personal page on a free service, like MySpace or Blogspot. They don’t know much about how web pages work, probably. But the free web site they use gives them the option to put images on their web site. Most give them the option to host the images in their own space, but they also give the option to hotlink, which is easier.

Hotlinking is when you have a web site, and instead of using images in your disk space, you decide to use images on my disk space. It’s actually pretty easy to do: in the web page code, just paste the address of the image from another site. When anyone looks at your page, their browser will see the address for the image, go there, get it, and incorporate it into your web page.

In short, even though the image appears on your web page, the actual photo resides on my web site. And every time someone views your web page, my web site gets hit with the traffic charge. This all happens seamlessly in the background; the person viewing your site has no idea that the image they see on your page came from somewhere else. They don’t get alerted that their browser is actually accessing multiple sites to patch together the page they’re looking at.

For me, it’s a bad deal all around. Someone is using an image I own without my permission. But worse, they’re making me pay for it. I pay to host the image and for the traffic charges. And 99 times out of 100, the hotlinker gives no credit to me at all. I wish I could come up with a layman’s analogy, but there’s nothing exactly like this in the physical world. It would be as if someone arranged it so that when they used their car, gasoline from your car’s gas tank gets used up.

To even be aware of this, I have to carefully study my statistics, which tell me things like a certain web site accessed a certain photo image on my site 1,330 times in the last few days. That happened to me–somebody on MySpace used a large wallpaper image of fireworks from my site as their wallpaper, hotlinking the image. The image is 350 KB. 1,330 accesses of that image costs me half a gigabyte in bandwidth.

There is an option in my web site control panel that blocks hotlinking. The problem is, if I turn it on, half of my visitors can’t see any images on my site. Clearly not all the browsers work right in this regard.

There is one rather vengeful solution: whenever somebody hotlinks to an image on your site, you control the image. If you change the image, the change instantly appears on their site. In the gas-stealing analogy, that means if you spike your gas with sugar, their gas tank gets trashed. I do that sometimes, if the hotlinker is obnoxious. I first have to change my own blog post using the image so it instead uses an alternate copy of the image with a different name. Then I alter the original image which someone is hotlinking so that it says or shows whatever I please, shrinking it so it only takes up a tiny amount of space. Presto! The hotlinker’s web site now proudly sports whatever image I chose to show.

I wish people (mostly teenagers making “kewl” free pages or referencing my images on private forums) would get a clue and use better netiquette. Free image hosting is rampant on the web, and while it may take a few more mouse clicks to do it, it’s honest and you don’t have to worry about the images disappearing off or changing on your web site, out of your control.

Has anyone else been getting this? About 20 spams sent to your site per day–but none of them have any spam URLs. All of the links are to legitimate sites, major corporations and such. The messages in the spams are highly complimentary of your site, with a bit of gibberish in there sometimes. Every time it’s a different name (aside from an occasional repeat), a different email address, a different IP address, and a different message variation. The spammer has been keeping this up for the past five days solid. What’s the deal with this idiot? If he’s testing his systems, isn’t this going on a bit too long? Of course, my spam filters stop any from getting through, but you gotta wonder about the guy’s sanity.

Then there’s this “grandpa stole bets” joker, someone who posts by that name, and clearly uses spam software (Google the name, you’ll see) to spread this bizarre comment all over the place. A deranged, rambling, conspiracy-theory-laden, anti-Christian, anti-Semitic tirade. I can only guess that some 12-year-old got hold of some primitive spam software and thought it’d be fun to pee all over the blogosphere.

None of these are really annoying as the filters do such a good job of keeping them out, but when you peek at some of these pieces of waste before they get zapped, it makes you wonder as to who’s out there, and if their medical insurance covers Mad Cow Disease.

Well, I’ve pretty much given up on using my stats in any meaningful way. The referral spam I’m getting is simply too overwhelming. As I’ve stated before, the spammers don’t gain a damned thing–not a single link, no Google Juice, no benefit whatsoever, zilch. But that doesn’t stop them from sending massive amounts of referral spam. The top 107 “referring” pages in my stats are all spammers, the most prolific being a child porn site and some strange, undefined quasi-fanfic site; those 107 referrers slammed this site with 6,850 fake referrals in just two weeks. Only a tiny handful of the top 1000 referrers, responsible for over 20,000 hits on my site, are legitimate; hunting them down within the steaming morass of festering spam is hardly worth it.

Until the developers of AwStats (go ahead, tell them) take their heads out of the sand and finally realize that their product is worthless until they institute a simple spam filtering subroutine, I’m just going to have to do without stats except in the most limited of ways (like checking how many times a specific file was downloaded–for example, my brother’s fanfic novel, Harry Potter and the Veil of Mystery, is still enjoying about 160 downloads a month, half a year after I began offering it here). It’s too bad, stats are fun.

My most recent site project is to create a page where I can showcase all my birding photos. Eventually, the page will include a title bar with links to maybe eight or ten pages that will appear below that bar when the links are clicked. Each page will hold ten to sixteen photos, 450 x 310 pixels (the standard size I use), each one of those being a clickable link to a 1000 x 800 pixel blowup. I did some preliminary work over the weekend.

Right now I’m just trying to design the basic page template, and decided to go with each picture “frame” being part of the background image, with a carefully measured table placing the photos and text accurately within each “frame.” It looks OK on my computers and with the browsers I use, but I wanted to ask others if it looks OK on yours. If you’d like to help, please visit the test page (if you are reading this past November 2005, the page has been completed) and tell me if the images and the text below them all appear nicely within the frames. Please keep in mind that the blowups are not yet available–this is just a test of the basic page graphics alignment.

By the way, the page I’m making is not designed downward for people with monitor resolution less than 1000 pixels wide; I figure that’s out of date enough, and I don’t want to resize all my photos for a minority of viewers–for them, the page will simply scroll offscreen to the right a bit.

My own results show the page rendered fine in Mozilla, Firefox, and Safari on a Mac, and Mozilla, Firefox, and Internet Explorer on Windows XP. At first, all but IE were fine, with Explorer showing the photos out of frame; it turns out that Explorer alone of all the browsers I tested has a unique default page margin setting (Explorer’s different from the rest, surprise!), but by setting the BODY command attributes “TOPMARGIN” and “LEFTMARGIN” to 8 pixels each, it seems to fix IE, and the other browsers are compatible.

But I would like to know if any of your results differ from those above, for the better or for the worse. Just leave a comment below and let me know how things look screwy. Thanks!

I am turning off TypeKey on this blog for the time being. It is so screwed up that the TypeKey cookie expires after only a few minutes. Even when trying to comment on my own blog, if I don’t type and save my own comments within a few minutes after logging on to TypeKey, I get shut out. Completely. Not only will my comment not be accepted, but even if I log out and try a normal comment, it will not register. Even if I open another browser and try an anonymous comment, the comment will not register. Even if I go to a different computer and try, the comment will not register. Somehow, because I did not click the “post” button on the comment within three minutes of logging into TypeKey, the damned system actually locked my own IP address out of my own blog comment system. But only for the post I tried to comment on. How completely screwed up is that?

Furthermore, it performs this way in an even more bizarre fashion. After attempting to comment, the “thank you” message appears, and says that my comment is in the registration queue. But the comment does not appear there, does not generate an email, and apparently just completely vanishes. And no matter what I try, the state persists for hours. This problem has been bugging me for a few months now, but today it elevated to new heights of absurdity. I am ready to trash the whole system and just have unregistered comments from everyone, to be moderated equally. Sorry, but I refuse to use a system that locks me out of commenting on my own blog.

While Comment and Trackback spam are under tight control, the referral spammers have broken through the AwStats referral patch; despite quickly adding any new spammers to the list, blacklisted domains continue to break and flow through. As always, the spammers get zero benefit–the spam is visible to me and no one else, and no links at all go back to them. But now it seems like they’re just doing it for fun–as is marked by the fact that the referral spam almost invariably accesses blog entries I have made on spam. So we’ve gone from aggressive advertising to pure vandalism, not that any spammers out there are anything but vandals.

Next step: wait for someone to create a better site statistics filter. Probably the folks at AwStats should rework the software so as to include this natively, allowing for manual control of filtering–but more important, retroactive filtering, a la MT-Blacklist. The current patches only stop spams as they come in, and they miss a certain amount even if they are working. It seems like such an obvious thing–referral spam is making AwStats useless, so one would only imagine that the people who make AwStats would do something about it.

A few things I’ve observed. First of all, about referral spammers (read this post for a definition of that). Recently one firm which figured out how to get past the filters has been hammering the site steadily. But what’s interesting is that they consistently hit two specific entries–both of them about spam. I’ve noticed this before in the past: when spammers hit you, they more often than not target entries in the blog which talk about spam (as they will with this post, no doubt). One can only imagine that this is their sick, twisted way of giving you the virtual finger–complain and we’ll target you. Swell people, these blokes.

My visitor count is going very high so far this month, perhaps 20% higher than usual lately. I thought it was the high-volume spammers, but a closer inspection of my logs shows they’re using a single IP address–not responsible for the increased number of unique IP hits. Strange. Sometimes I have no idea why more people start coming–though I suspect it has to do with breaking thresholds in Google listings somehow (don’t ask me how that works, though I suspect chicken entrails are involved).

And finally, you may have noticed my special note in the side bar and above the comments area mentioning the trouble I’m having with the TypeKey comment system (if you are reading this well after publication, the note is probably long gone). In order to assist in figuring out the problem, I published a temporary email address for people to contact me if they had trouble with the comment system. Well, I got one or two such emails… and now a lot of spam. For those who don’t know, posting your email address on a web page, any web page, is a glaring invitation to get spammed. Spammers have automated programs that continuously read web pages and harvest any and all email addresses from them (which is why I never require commenters to leave an email address).

What’s more interesting is that the scam spammers, and not the ad spammers, seem to be the ones who use this most. As with my experiment a while back, the published email address garners not so much ads to buy things, as it does more emails from Nigerians with millions to route through my bank account, and European lottery officials informing me that I’ve won millions, and so just pay the processing fees and the check will be in the mail. Specifically, after only just a few days of life, the email account has received three Nigerian emails, one European Lottery email, one spammer trying to trick me into putting a “reciprocal” link on my site, and one more trying to get me to advertise for them on my site. So once again: don’t publish your email address on any web site unless you really, really like Nigerians.

From a spate of blog comments spam I just received, it now appears that spammers are no longer just spamming, they are now using spam for no other reason than to abuse bloggers, perhaps even to turn them against each other. I got dozens of blog comment spams which had three URLs in them–all bloggers. I am giving them all the benefit of the doubt, as I sincerely question the idea that these three bloggers all got together and asked for spam to be sent featuring random posts from their blogs. One of them is even a blogger I read regularly.

So that means that some scumbag spammer out there probably chose blog posts from bloggers he usually attacks, and inserted them in the spam. No link to the spammer, no profit to the spammer, no comprehensible reason why the spammer would send such spam–except for the sole reason of pissing off bloggers. One effect may be that the bloggers’ URLs may now be added to spam blacklists, meaning that legitimate comments that link to these guys’ blogs may be blocked close to everywhere in the blogosphere from now on–the blogosphere’s equivalent of a bad credit rating. Hopefully the people who manage these blacklists will realize what’s going on and remove the URLs from the lists.

It may even have been a test of a new spam system, just to see if it works. In the past, there have been spam attacks with no rhyme or reason, using an inoffensive link or even having no links at all. I noted that in this attack, each spam had a different fake IP address, and rotated name and email addresses, making it harder to delete from the database; this is not exactly new, but it may be a test of a technique to make it harder to filter and delete the spam. Not that a single one ever got through Movable Type’s comment moderation on my blog, and previous versions of MT-Blacklist would have made it easy to zap the common URLs. This is also the second morning in a row I’ve awakened to a massive spam attack, both of different yet persistent types, so it could be the same sleazeball trying out different methods. If so, the idiot didn’t get himself anything. But then, it seems that such was not the point of the exercise.

Good news on the referral spam front: only 6 of the top 25 referrals were spammers, for a total of 187 hits between them. Lots more spammers with only a few hits per in the complete list, but this is a hopeful sign.

On the other hand, comment spam has started rising again, but mostly due to one porn web hosting company which sends hundreds of blog comment spams through each and every day, and has been for a few months now. Not a single one has made it onto the blog, of course, but they continue to spam away.

One more note: after peaking in April, visitor numbers have more or less held steady since then, though in the past month or two the number of spammers in the totals has been cut by the AwStats filter. Nevertheless, this month had the highest number of total unique visitors per month–22,554, a hundred or so higher than April, when spammers were fully counted in that total. Still, with some spammers getting through, the number of real visitors is more likely closer to 20,000, probably under that.

Not a big deal here, but this one web site caught my attention because of their high score on the sliminess scale. First of all, I found them because they referral-spammed me. Whenever a new address appears on my referral list, it could either be (a) a legit site with a link to my page sending real people my way, or (b) a spammer. Sometimes the domain name gives it away, as is the case with most porn sites, for example. But often times the domain name seems innocuous but may be spam, so I have to check it out before putting it on my blacklist.

Now, when I do this, I never click on the link my stats page generates–because if I do so, the spammer will see where I came from, and that’s a no-no. So I copy and paste the URL into a blank window, making it a direct referral with no traceback to the origin. Will I contribute to the spammer’s number of visitors? Yes, but I don’t care, I’m not buying anything so it does them zero good.

When I got to this site, I found that they were selling something with the quite asinine name of “Blog Blaster.” Yep, they were selling people on plastering their ads on blogs. Swell. By the way, it seems that their primary target is a free blogging tool called “GetFreeBlogs.com,” so you will want to steer clear of that place. But what really caught my attention was the prominent logo on the spammer’s site: a big “no-spam” mark, the word “spam” with a red circle and a line through it. I just love it when spammers claim they are against spam; that’s Burnham-style.

Considering that I found them via their spamming me, that’s just too precious.

---

By the way, I’ve noticed something new about referral spam that has a relation to email spam: they’re starting to mark the spam with tracking codes. When I started looking into email spam way back, I noticed that some of the links in emails had nonsense text-strings as part of the web page address–for example (fake address), http://spammer.com/ksjb39p4qh/ or something like that. I soon figured out what the nonsense was: a tracking code. When the spammer sends the email spam, each spam has a different link tracking code which they associate with a different email address. Without that, they don’t know which spam victims came back to them, which email addresses were active and reading spam. But if the unwary victim clicks on the link, the referral they generate will identify them in the spammer’s database.

Now it appears that referral spammers are using the same method. Apparently the trick I used above to avoid creating an identifiable referral for the spammer to know where I came from, is common enough for spammers to want to get around it–or there is some other element to the game I’m missing. Either way, the referral spammers are now tagging their spam to get more info on who is coming back to them. Sneaky. Slimy. And busted–I’m not falling for it.

Okay, TypeKey is beginning to really tick me off.

First of all, I can’t stay logged into the damned service. It seems to expire within fifteen minutes or so. I use Safari with PithHelmet, and have been very careful to remove all restrictions on cookies from both preferences; both my site and the TypeKey site have full allowance to use whatever cookies they want, for an indefinite length of time. Ergo, if the TypeKey cookie allows you to stay logged in, my browser is fully set to allow that.

However, despite TypeKey’s “keep me logged in for two weeks” option, the cookie expires rapidly. Now, it is annoying to have to sign in every single time I comment, but that I can live with. However, the login expires so rapidly that it sometimes cuts out before I can even post a comment (which often takes me some time to do). It also expires if I write several comments over several posts and take too long to do it. Worse yet, when it expires, there is no going back short of quitting the browser. Even if I log out of TypeKey and sign myself back in, my blog treats me as if I’m never logged in, even if it says I am. And worst, if I submit a comment in that state, the comment will be generated in my control panel for my blog, but it will never appear in the blog itself, no matter how I save or rebuild.

Has anyone else experienced this?