(Click the chart to embiggen.)

Congratulations to WordPress for making the Theme Directory a success.

WordPress Theme Directory After Four Months

Deneen Carrillo | aejqtb@lobhyi.com | IP: 94.102.60.151

5wj9j1bdvd74zbcv

A real looking name, an obviously fake email address (usually with a non-existent domain name, which should immediately flag the comment as spam if WordPress or Akismet were intelligent), an IP address from 94.102.60.151 94.102.60.152 or 94.102.60.153, and 16 random letters or numbers.

The user agent strings varied widely:

• Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
• Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
• Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
• Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
• Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
• Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.7) Gecko/20070914 Firefox/2.0.0.7

The bot also submitted every form on the page, including the search form and the submit box. Maybe a simple form should be created to auto-block anyone that submits anything to it. And the bot never downloads images or anything other than the page. Maybe a plugin should could check that a user downloaded some other content before allowing a comment to be submitted? Yes, this forms a horserace, but it may work in the short term.

Odd Comment Spam Attempts

Any time a user has to do anything to stop getting stuff he didn’t ask for, it’s spam. Period. If busenetwork.net can show to me proof that I signed up for this, fine. But they can’t. Therefore it’s spam and illegal.

Spam from Dell via busenetwork.net; or Why Opt-Out Is Still Bad.

iWork ‘08 Demo Requires Your Email Address

McCain: Ok, well, we need to find me a vice-president. The convention is next week.

Advisor: Anything you say Senator. I guess it is an important decision.

McCain: Nah, not really. What does the veep do anyway?

Advisor: Not much usually. Sometimes the VP gets to vote in the Senate. What are your criteria for your vice president?

McCain: Well now, let’s work that out. They need to have experience governing.

Advisor: Governing? So you want a governor?

McCain: Yes. And a Republican, of course.

Advisor: Why, Senator? You’re a maverick; maybe we should choose a Democrat.

McCain: Well, that’s an interesting thought.

Advisor: Hillary made the Democratic race pretty exciting.

McCain: I wonder if she’d want be interested?

Advisor: I think I read somewhere that she only wanted to be President. I don’t think I’d sleep too well if she were one heartbeat away from my Presidency.

McCain: Good point. So, let’s stay with our own party for now. I think we need a woman to cash in on the female voters that won’t vote for Obama and Biden.

Advisor: Of course. I think we can work with that.

McCain: And she needs to have serious foreign policy expertise. Do you think we can find anyone that fits all of those criteria?

Advisor: Let me look. Hmm, Wikipedia lists 56 choices for Governor.

McCain: 56! I thought we only had 50 states. That wackypedia thing can’t be right. You know, I can’t even type. Hey, can Cindy be my vice president?

Advisor: Let’s stay focused sir. The United States has six territories as well.

McCain: Oh yes.

Advisor: Now, of those 56 leaders, 23 are Republicans.

McCain: Excellent, it looks like we’re getting somewhere.

Advisor: And there are only 3 female Republican governors: M. Jodi Rell of Connecticut; Linda Lingle of Hawaii; and Sarah Palin of Alaska.

McCain: I don’t know any of them. What about their foreign policy expertise?

Advisor: Sorry, Senator, I’m not sure either. Anyone have an atlas? (delay) Well, Connecticut is on the East Coast, so she’s out. Hawaii is 2,000 miles away from any other landmass, so what experience could there be out in the middle of the ocean?

McCain: Wasn’t Obama born in Hawaii? That could be a plus.

Advisor: Yes, he was. But look, sir, the map shows that Alaska actually touches Canada. And Russia is just across the Bering Strait.

McCain: Wow, this Gov. Palin looks like a mighty strong candidate. Let’s get her! I sure hope those reporters ask her about her foreign policy expertise.

Advisor: Yes sir!

Transcript of McCain’s Process For Picking Palin

My guidelines for identifying comment spam that doesn’t get caught by Akismet:

1. If the “name” is not a first and last name, the comment is probably spam. It will at least get a closer look.
2. If the “name” is not a name at all (furniture, travel deals, SEO-anything) the comment is spam.
3. If the “email” is from China or Russia, the comment is spam.
4. If the “email” looks fake, the comment is spam.
5. If the site at the “URL” is not in English, the comment is spam.
6. If the site at the “URL” feels spammy (an entirely subjective opinion), the comment is spam.
7. If the comment itself has links to the poster’s web site, like an email signature, that signature will get removed from the comment. Plus if the signature URL is different than the “URL” field, the comment is spam.

If the comment passes all of these items, then I check my web server’s log files to find where the user came from. Look at this spammer:

75.101.138.119 - - [22/Sep/2008:21:35:36 -0400] “GET /2008/06/26/helo-bot-hostname/ HTTP/1.1″ 200 23602 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)”
75.101.138.119 - - [22/Sep/2008:21:35:39 -0400] “POST /wp-comments-post.php HTTP/1.1″ 302 1 “http://www.planetmike.com/2008/06/26/helo-bot-hostname/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)”
75.101.138.119 - - [22/Sep/2008:21:35:43 -0400] “GET /2008/06/26/helo-bot-hostname/#comment-15818 HTTP/1.1″ 404 19992 “http://www.planetmike.com/2008/06/26/helo-bot-hostname/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)”

They’re coming from Amazon’s Web Services (75.101.138.119 is ec2-75-101-138-119.compute-1.amazonaws.com). Hmmm, weird. They originally came to my site from nowhere, ie a bookmark or typing my URL into their IE 6 web browser. It only took them three seconds to read the page, enter their comment, and submit their comment. Not likely. This comment was spam.

After looking at the server log, if I’m still not sure if its a real comment, I generally, but not always, will approve the message but may remove the URL so there isn’t a link from the comment.

Sometimes a Comment Is Simply a Comment

Why is Facebook so slow?

WordPress 2.6.2 Upgrade Completed

? = Toggle help screen
M = Change mode
P = Change palette
I = Display track info
C = Toggle auto-cycle (on by default)
F = Toggle freeze mode
N = Toggle nebula mode
L = Toggle camera lock

Hit “F” then play with the “m”odes. Very nice.

iTunes 8 Magnetosphere Visualizer Help

And why doesn’t Netcraft use www for their web site in their domain? Can you think of any other sites that don’t use www or nothing in front of their domain name?

Netcraft Oddities