How spammers spams your blog comments

by Jean-Baptiste Jung. 43 Comments -

As a blogger, everyday I’m receiving hundreds of spam comments. I was very curious about how spammers can sends so many automated comments to thousands of blogs. Here’s an exemple which demonstrate how to spam blogs using PHP and Curl.

This article is for educationnal purposes only. It was written to help bloggers knowing one of the technics used by spammers to spam their blog, not to encourage spam of any sort.
Blog spamming is useless, anyways: Most blogs have the Akismet antispam and manually moderate comments.

Part 1: getting info

The first thing the spammer will have to know, is how your comments form works. Most WordPress comment forms works exactly the same manner, and this is probably why spammers can spam so many blogs easily.
Here’s a “basic” WordPress comment form:

<form action="wp-comments-post.php" method="post" id="commentform">
 <p>
    <input type="text" name="author" id="author" value="" size="30" tabindex="1" />
    <label>Name <span class="required">
    (required)    </span> </label>
  </p>
  <p>
    <input type="text" name="email" id="email" value="" size="30" tabindex="2" />
    <label>Email <span class="required">
    (required)    </span></label>
  </p>
  <p>
    <input type="text" name="url" id="url" value="" size="30" tabindex="3" />
    <label>Website</label>
  </p>

<p>
    <textarea name="comment" id="comment" cols="100%" rows="10"></textarea>
</p>
<p>
    <input type="image" src=submit.png"/>
    <input type="hidden" name="comment_post_ID" value="524" />
    <input type="hidden" id="_wp_unfiltered_html_comment" name="_wp_unfiltered_html_comment" value="0d870b294b" />
</p>
</form>

To submit a comment throught that form, we must fill the following fields:

  • Name (author)
  • Email (email)
  • Website (url)
  • Comment (comment)

There’s also 2 hidden fields:

  • comment_post_ID
  • _wp_unfiltered_html_comment

Part 2: Creating the script

Now that we have the required info, we can start to code our spam-script, using PHP and Curl. We are going to define an array ($postfields) containing the info that we’d like to pass to the page.

<?php
$postfields = array();
$postfields["action"] = "submit";
$postfields["author"] = "Spammer";
$postfields["email"] = "spammer@spam.com";
$postfields["url"] = "http://www.iamaspammer.com/";
$postfields["comment"] = "I am a stupid spammer.";
$postfields["comment_post_ID"] = "123";
$postfields["_wp_unfiltered_html_comment"] = "0d870b294b";
//Url of the form submission
$url = "http://www.ablogthatdoesntexist.com/blog/suggerer_site.php?action=meta_pass&id_cat=0";
$useragent = "Mozilla/5.0";
$referer = $url; 

//Initialize CURL session
$ch = curl_init($url);
//CURL options
curl_setopt($ch, CURLOPT_POST, 1);
//We post $postfields data
curl_setopt($ch, CURLOPT_POSTFIELDS, $postfields);
//We define an useragent (Mozilla/5.0)
curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
//We define a refferer ($url)
curl_setopt($ch, CURLOPT_REFERER, $referer);
//We get the result page in a string
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
//We exits CURL
$result = curl_exec($ch);
curl_close($ch);

//Finally, we display the result
echo $result;
?>

All right. Now the spammer just have to call the script, and it will automatically post the message.
Of course, a real spammer will not manually type the blog post url in his script, but loop throught a csv file, or even google results, but I’m not going to say much about that since this code is only an exemple, and definitely not a functionnal spam bot.

This tutorial was inspired from this excellent article from French website www.seoblackout.com.

Comments (43) - Leave yours

  1. Mac Apps said:

    That is really interesting. I get hundreds of pieces of spam every day and it is driving me crazy. Is there anyway in which you can easily stop spam from ever reaching your filter?

  2. jbj said:

    Captcha stops spam efficiently, but I hate solving captchas so I’m not going to do that on my own blogs. Personally, I use Akismet (Which works great) and manual moderation.
    I heard about a hack to stop 90 percent of spam without a captcha, I should talk about it in a future article!

  3. Jamie Souef said:

    Great post! I never new how it was done (not that i want to do it myself but it’s interesting non the less.. )

    Akismet is great, but one that I’m using on my WordPress MU installation is Monty Spam which is proving to be fantastic. It’s only for MU at the moment but i believe it’s going to be coming to the single install of WP

  4. jbj said:

    Thank you Jamie. Indeed, spamming is not a good thing and no-one can have real benefits from it.
    Nice info about Monty Spam, i’ll forward to it!

  5. ton said:

    “There’s also 3 hidden fields:” Umm…didn’t you mean ‘There’s also 2 hidden fields’. From looking at the html that’s what I found. Also, it seems that only the ‘Name’ and the ‘Email’ fields are required from looking at the html.

  6. jbj said:

    @Ton: You’re right about hidden fields, there’s only two. Thanks for correcting my mistake.
    Yes, only name and email are required, but in case of spamming, you have to provide an url.

  7. Jeff Barr said:

    Based on this post, here are some ideas. These are specific to WordPress but could be adapted to work with other blogging engines.

    1 – Rename wp-comments-post.php to something that is specific to the site. This would force potential spammers to do more work to figure out the name of the program to invoke.

    2 – Similar to #1, rename some of the input fields in the form.

    3 – Emit a random “magic cookie” value inside of a hidden form field. Then refuse to post the comment unless this value is present.

  8. jbj said:

    @Jeff Barr:
    Good ideas here. Another antispam that I created for another blog was to create a new hidden field, and then, verify if this fields is empty.
    As robots tends to fill all fields they can find, if the field is filled, you can say it’s spam.
    That worked quite well on a small blog, but some spams managed to bypass it.

  9. Andrew said:

    On my blog the name of the form fields are randomised, stored in a session variable, and regenerated within a specific timeframe, so grabbing the form and using the form variables only works if you are accessing it within the same session and within a set period of time.

  13. Web Designer in Perth said:

    I’m relatively new to blogging (WP) and already the target of too much spam, some of which I’ve been able to combat with IP blocking (but I know that’s a losing battle).

    I like the sound of adding an additional hidden field and verifying it’s empty. Would anyone care to share how it’s implemented?

  14. jbj said:

    @Web designer: The idea of adding a hidden field sounds great, but to apply it you have to modify WordPress core, which isn’t recommended. Why not trying Andrew’s plugin first? It sounds very promising!

  16. James Mann said:

    It would be nice if you could turn things around on spammers. I get so annoyed but Akismet catches and stops about 98% of the spam I get, maybe more. I do have one site that I get two spam comments that get through every day. Which is better than having the hundreds that get stopped from coming trhough.

  17. Lucho said:

    I “had” a blog that at some point received so much spam, no matther the filter I was using that I went crazy and deleted it. What was even worse is that I would receive the exact same comment from the exct same person hundreds of times per day!!! You know those moments when you do idiot things.
    Anyway, it si good to know how they do it

    I dont have a blog right now, dont have time with all the work I have at this website but eventually I will start a new one.

    www.chico-chihuahua.com

  18. MOin said:

    i wish a curse for spammers they really polute blogosphere and kill the reputation of some real commenters and its really good to know how they start spamming and nuke a website.

  22. Eva White said:

    I used to always wonder how they should waste time and effort on spam…now I know better. They have automated the whole thing…No wonder they are so persistent and irritating.

  29. Matt Helphrey said:

    Thanks, now Im gonna go out and spam the world! Nah I really don’t like spammers so much. I was wondering how in the world they did manage to do that, so thanks for the insight. And thank god for Akismet!

  31. blogslammer said:

    BlogSlammer does not spam blogs… I am the owner of this and want to reiterate it does not spam other people’s blogs.

    It just allows you to post content accross multiple blogs and automates this process. The blogs it posts to are blogs the user owns.

  34. Oil Paintings Reproductions said:

    The good thing here is that Akismet is doing a good job against those spamers. If you just try that piece of code for sure Akismet will be very glad to catch you, so there is no need to change to Typepad or any other blogging system, WordPress is fine.

  35. Firany said:

    ReCaptcha works fine for me. Automatic spamming wordpress forms is quite easy but if you change your code just a bit robots will fail. Giving just a small change ruins bots efforts.
    Just install Akismet & captcha & change your code a bit and you’ll have 100% of automatic spam rejected.

  37. Koral said:

    The spam amounts can get crazy. Captcha helps a lot!.
    Be careful not to delete a whole list of comments in frustration as there may be a some legitimate ones too, if not this will block these users posting on ALL blogs with Akismet.
    This filter is creating issues for many good bloggers too.

  39. Moe said:

    We have a problem on our site – someone puts a word called array on the comments page of our blogs which in turn hides all the comments that readers leave – is there a way we can prevent this from happening. Most of the bloggers face this problem in their comments field which makes it very annoying. Will appreciate any advice.

    Thank you

  40. vinaction said:

    in spite of time then this post was wrote, its a good information! But spammers have found how to come through the Akismet.
    Only hope is manual moderation! )

  41. Jennifer R said:

    This type of comment spam easily blocked by Akismet but some tools like Scrapebox… use their own web browser to auto submit comment and so on, Akismet was failed, maybe your blog should include Captcha verifier :D

  43. chanhope said:

    yea so many spams on my blog if that akismet plugin not available i think wordpress blogs will be dumped with spams. link building is a good part of SEO but spamming for link building is really a negative part.

Leave a Reply

Your email address will not be published. Required fields are marked *

*

Please respect the following rules: No advertising, no spam, no keyword in name field. Thank you!