Friday, June 26, 2009<\/p>\n
\n You’re a good webmaster or web developer, and you’ve done everything you can \n Many of your site’s visitors will create user profiles, and some will spend hours posting in \n Others, however, will create accounts and fill their profiles with gibberish, blatherskite and \n Welcome to the world of spam profiles. The social web is growing incredibly quickly and spammers Imagine the following scenario:<\/p>\n \n “Hello there, welcome to our new web2.0 social networking site. Boy, have I got a new friend for \n Not interested? Then let me introduce you to my dear friend \n You probably don’t want your visitors’ first impression of your site to include inappropriate \n Spammers create fake profiles for a number of nefarious purposes. Sometimes they’re just a way \n Spammers are also using spam profiles as yet another avenue to generate webspam on otherwise \n The latter case is becoming more and more common. Some fake profiles are obvious, using popular \n You may be thinking to yourself, “But my site isn’t a huge social networking juggernaut; surely \n For all of you out there who do work for huge social networking juggernauts, your site is a target \n This isn’t an easy problem to solve – the bad guys are attacking a wide range of sites and seem to
\n to keep your site from being hacked<\/a>
\n and
\n keep spam out of your forums and comment sections<\/a>.
\n You’re now the proud owner of a buzzing web2.0 social community, filling the web with
\n user-generated content, and probably getting lots of visitors from Google and other search
\n engines.\n<\/p>\n
\n forums, joining groups, and getting the sparkles exactly right on the rainbow-and-unicorn image
\n for their
\n BFF<\/span><\/a>‘s
\n birthday. This is all great.\n<\/p>\n
\n palaver. Even worse, they’ll add a sneaky link, a bit of redirecting JavaScript code, or a big
\n fake embedded video that takes your users off to the seediest corners of the web.\n<\/p>\n
\n look at every kind of user content on the web as an opportunity for traffic. I’ve spoken with a
\n number of experienced webmasters who were surprised to find out this was even a problem, so I
\n thought I would talk a little bit about spam profiles and what you might do to find and clean
\n them out of your site.\n<\/p>\nWhy is this important?<\/h2>\n
\n
\n you. His name is Mr. BuyMaleEnhancementRingtonesNow<\/span>, and he’d love
\n for you to check out his profile. He’s a NaN-year-old from
\n Pharmadelphia<\/span>, PA and you can check out his exciting home page at
\n https:\/\/example.com\/obviousflimflam<\/span>.\n <\/p>\n
\n PrettyGirlsWebCam1234<\/span>, she says she’s an old college friend of
\n yours and has exciting photos and videos you might want to see.”\n <\/p>\n<\/blockquote>\n
\n images or bogus business offers. You definitely don’t want your users hounded by fake invites
\n to the point where they stop visiting altogether. If your site becomes filled with spammy
\n content and links to bad parts of the web, search engines may lose trust in your otherwise
\n fine site.\n<\/p>\nWhy would anyone create spam profiles?<\/h2>\n
\n to reach users internally on a social networking site. This is somewhat similar to the way email
\n spam works – the point is to send your users messages or friend invites and trick them into
\n following a link, making a purchase, or downloading malware by sending a fake or low-quality
\n proposition.\n<\/p>\n
\n good domains. They scour the web for opportunities to get their links, redirects, and malware
\n to users. They use your site because it’s no cost to them and they hope to piggyback off your
\n good reputation.\n<\/p>\n
\n pharmaceuticals as the profile name, for example; but we’ve noticed an increase in savvier
\n spammers that try to use real names and realistic data to sneak in their bad links. To make sure
\n their newly-minted gibberish profile shows up in searches they will also generate links on
\n hacked sites, comment spam, and yes, other spam profiles. This results in a lot of bad content
\n on your domain, unwanted incoming links from spam sites, and annoyed users.\n<\/p>\nWhich sites are being abused?<\/h2>\n
\n I don’t need to worry.” Unfortunately, we see spam profiles on everything from the largest social
\n networking sites to the smallest forums and bulletin boards. Many popular bulletin boards and
\n content management systems (CMS) such as vBulletin, phpBB, Moodle, Joomla, etc. generate member
\n pages for every user that creates an account. In general CMSs are great because they make it easy
\n for you to deploy content and interactive features to your site, but auto-generated pages can be
\n abused if you’re not aware.\n<\/p>\n
\n as well. Spammers want access to your large userbase, hoping that users on social sites will be
\n more trusting of incoming friend requests, leading to larger success rates.\n<\/p>\nWhat can you do?<\/h2>\n
\n be able to adapt their scripts to get around countermeasures. Google is constantly under attack
\n by spammers trying to create fake accounts and generate spam profiles on our sites, and despite
\n all of our efforts some have managed to slip through. Here are some things you can do to make
\n their lives more difficult and keep your site clean and useful:\n<\/p>\n\n
\n CAPTCHAs<\/a>,
\n to make it harder for spammers to create accounts en masse. Watch out for unlikely behavior –
\n thousands of new user accounts created from the same IP address, new users sending out
\n thousands of friend requests, etc. There is no simple solution to this problem, but often
\n some simple checks will catch most of the worst spam.\n <\/li>\n
\n fake profiles on one innocent site all linking to the same domain, so once you find one, you
\n should make it simple to remove all of them.\n <\/li>\n
\n cross-site scripting (XSS) vulnerabilities<\/a>
\n <\/b> and other security holes that allow spammers to inject questionable code onto their
\n profile pages. We’ve seen techniques such as JavaScript used to redirect users to other sites,
\n iframes that attempt to give users malware, and custom CSS code used to cover over your page
\n with spammy content.\n <\/li>\n
\n adding rel=\"nofollow\"<\/code> to the links<\/a>
\n on untrusted user profile pages.<\/b> This makes your site less attractive to anyone trying to
\n pass PageRank from your site to their spammy site. Spammers seem to go after the low-hanging
\n fruit, so even just nofollowing new profiles with few signals of trustworthiness will go a long
\n way toward mitigating the problem. On the flip side, you could also consider manually or
\n automatically lifting the nofollow attribute on links created by community members that are
\n likely more trustworthy, such as those who have contributed substantive content over time.\n <\/li>\n
\n a noindex<\/code> robots<\/span> meta<\/code> tag to profile pages<\/a>
\n <\/b> for new, not yet trustworthy users. You may even want to make initial profile pages
\n completely private, especially if the bulk of the content on your site is in blogs, forums,
\n or other types of pages.\n <\/li>\n
\n you solve the problem – they care about your community and are annoyed by spam too.\n <\/li>\n
\n Google Alerts<\/a> – set up a
\n site:<\/code> query along with commercial or adult keywords that you wouldn’t expect to
\n see on your site. This is also a great tool
\n to help detect hacked pages<\/a>.
\n You can also
\n check ‘Keywords’ data in Webmaster Tools<\/a>
\n for strange, volatile vocabulary.\n <\/li>\n
\n on your pageviews chart head upward, but pay attention to commercial or adult queries that
\n don’t fit your site’s content. In cases like this where a spammer has abused your site, that
\n traffic will provide little if any benefit while introducing users to your site as “the place
\n that redirected me to that virus.”\n <\/li>\n<\/ul>\n