On and off, for weeks, I've been getting comment spam similar to this:

<h1>You may find it interesting to check out some helpful info in the field of- Tons of interesdting stuff!!! </h1>

There's no URL associated with it, only an email address, usually from something like absinth968@hotmail.com, or absolut4806@freemail.com, though the numbers might change.

Although MT Blacklist will remove them, they have to be done individually, because there's no common URL or IP address to key on (fortunately they only come a few at a time, never, so far, in a flood). And also since there's no URL, there's no way to blacklist them in the future.

I don't understand what the purpose is. They're not getting any google effect, or even link through, since there's nowhere to link to. Are they just clueless comment spammers, who don't get the concept, or is this harassment, or what?

[Update a little while later]

Well, here's another one:

<h1>You may find it interesting to check out some helpful info about... </h1>

This one's from a " jane_doe7117@work.com."

No URL, no idea what (s)he's talking about, or why I'm being spammed with this stuff.

A while back I was getting some spma telling me that I was the winner of some Dutch or Spanish Lottery. Except there was no URL anywhere, no return email address in the headers, not even a physical address or phone number in the text. I couldn't have contacted the sender if I wanted to. (And there wasn't any graphics image, so they couldn't be trying to track me either.) So either the intellegence of spammers is bottoming out, or they've discovered ad campaigns.

Yeah, I get the no subject spam too and have done for months. Perhaps that's what happen when the little rat who runs those bots has no sponsors.

I've always assumed it's a spammer trying to figure out how their software works.

Or vandals.

Some people ruin other people's creations just for the sheer joy of destruction. Or maybe it's someone that doesn't like the threat that the Internet represents to their own power...

Try this in your Blacklist:

[_[:alpha:]]{3,}[[:digit:]]{3,}@[-[:alnum:]]+\.com

This means "at least 3 letters or underscore, followed by at least three digits, '@', then alphanumerics or dash then '.com'". It should be specific enough to block the spam without catching humans.

I've gotten spam that included empty link tags, such as <a href=></a> or some such; I had to open the message as a text file to find them. I put that formulation into an e-mail filter at my host server and it actually worked.

My theory is that such spammers are fishing for weblogs that don't swiftly remove spam comments, so that they can in future focus comments full of URLs against those softer targets.

I seem to get a lot of "referred by" and trackback spam now too. I think I'm going to have to find a better solution than the current MT Blacklist.

(My previous attempt, in which I used the phrase "U*R*L-l*a*d*e*n w*a*r*h*e*a*d*s" without the asterisks, was rejected as having unsuitable content!)