OK, I’m still getting these weird blog spams, like this:
A new comment has been posted on your blog Transterrestrial Musings, on
entry #4886 (Lousy Salesmen).
http://www.transterrestrial.com/archives/004886.htmlIP Address: 61.102.44.56
Name: Kimberly
Email Address: naomi@pochta.netComments:
Great work!
[url=http://aouyktgf.com/nntn/hzmj.html]My homepage[/url] | [url=http://wtjpdovz.com/iure/alke.html]Cool site[/url]
They tend to come in pairs, with the same nonsense URLs, but different email addresses and IP addresses.
I’ve been just deleting them without adding to the blacklist, because I don’t want to clog up my blacklist with these nonsense strings that seem to be one (or two) shot deals.
But how about refining previous attempts at a pattern match? Instead of just looking for a string of consonants, how about a string of five consonants containing at least one of the letters “z,” “x,” or “q”? That would seem pretty safe to me, from a false positive standpoint, and would catch most of them. If so, what would that regex look like?
And I’d like to know what the point is, other than annoyance. Any theories (other than perhaps incompetence on the part of the spammer)?