It took a long time for spammers to really start abusing pingbacks, because of two things: First, pingbacks require the remote site to link to your site before they can get you to link to theirs. Second, it was just so much easier to abuse trackbacks and ordinary comments. I guess those have gotten locked down enough that it’s worth the effort to target pingbacks now.

The pingbacks show up within a few minutes to a few hours of posting. When I look at the site, it’s running actual blogging software; often I can recognize a particular WordPress theme. But it’s got more advertisements (usually Google ads) than content, the title and description look very keyword-stuffed, and the about page, if any, is just default text. The 15-minute–old post linking to mine has already been pushed off the front page, or else there’s only one post there anyway. Often they don’t bother with friendly permalinks, and just have the p=12345 structure… and the number is very high.

And that post that links to mine? Something like, “XYZ wrote an interesting post on [post title]. Here’s an excerpt:” followed by the first few lines of my post, and yes, an actual link. The funny thing is they rarely bother to make XYZ match either my name, or the site’s name. It’s often completely random.

Clearly they’ve got some RSS search looking for keywords, like Prius or Toyota or Christmas, then they automatically generate an excerpt and post to a blog that’s been set up not for human consumption, but for machine reading, and wait for the hits to come in. (At least they’re just using excerpts. It used to be more common for this sort of site to copy entire posts, and that really pissed me off.)

There’s a screenshot of such a page at Masters of Media, along with some commentary on the failure of nofollow to deter spammers, and the irony that Google is making money off of them. Meanwhile, the Blog Herald goes into the mechanics and ethics of the issue.

I don’t want to disable pingbacks, because it’s a useful feature—just like comments or email. But it’s clear that my current countermeasures aren’t up to this type of spam. Bad Behavior won’t bat an eye, since they’re using actual blogging software to connect. Spam Karma doesn’t seem to be catching them. Sure, I can add some phrases to the blacklist, but I’ve already seen variants popping up. And I’m reluctant to use Akismet, because I don’t want to submit every comment to some other site for verification.

Any suggestions?

Update (Nov. 27): A couple of relevant posts popped up on the Dashboard today. It seems Akismet is running into problems with people marking these messages as not spam. Also, Lorelle discussed the related topic of content theft, in which sploggers repost not just an excerpt, but the entire article, in hopes of getting their copy of your content indexed in search engines.

Or maybe they have for a while, and they’ve only just started getting past my other layers of defense (namely Bad Behavior and other checks by Spam Karma).

*sigh*

I guess spammers like a challenge as much as anyone else.

Generally they tend to be story-type jokes, the kind you’ll find on, say, Jumbo Joke. This is probably an effort to build up enough comedic content to overwhelm the presence of links to a porn or pillz site. A similar technique had a brief heyday maybe a year ago in email spam, though I haven’t seem many of them lately.

It’s still spam—there’s no way I’m letting those comments and links onto the site—and Spam Karma still catches them. Still, it at least makes the spamtraps a little more interesting than the endless morass of links and keywords.

On another note, I’ve been seeing a lot more email spam targeting the abuse contacts lately. I don’t know what they think they’re accomplishing, since the people reading abuse@wherever are most likely to report them and least likely to buy from them. I mean, “Greetings Abuse!!!” doesn’t seem an effective way to begin a sales pitch.

FWIW, I use Spam Karma and Bad Behavior to block comment spam on this site.

(via Akismet)