But it didn’t catch a couple of… terse… commenters on this post about a presentation I was about to give. One commenter seemed rather irritated, and posted a malformed link to some addiction recovery place or another. A second commenter appeared to be much friendlier, and posted a few words mildly relevant to the presentation, but also added a link to another treatment center. And it’s just happening on this one post, as far as I can tell.

And this isn’t the garden-variety spam I’m used to seeing in Spam Karma 2’s reports. Which means it’s not getting caught with their Javascript test, their “Flash Gordon was here” test (comment posted just a few seconds after page load), etc. The comments contain one link, nothing formatted with BBCode, no unformatted links, and there are complete sentences attached to them that are just barely related to the post content.

Of all the posts I’ve got here, and all the opportunity for spam it provides, why this post, and why these spammers? The only thing the post and the spams have in common is the word “Tennessee”. Spammer 1 tried to link to an addiction recovery site with the word Tennessee in its URL. Spammer 2 successfully linked to a treatment center with the word Tennessee in its URL.

So I wonder, did I include the word “Tennessee” in this post enough to attract these folks’ attention? Will they post more spam here? Because if they do, what Spam Karma 2 doesn’t catch, I will. Word of advice, guys. I don’t get an enormous volume of comments here. In fact, I get few enough to where I’m normally able to look at them within minutes of their arrival. If they’re spam, they’ll get deleted. If you’re getting paid by the hour, I guess it doesn’t matter. If you’re getting paid by number of valid links left after some period of time, you’re better off spamming elsewhere.

Code Example:

/**
 * This holds the version number in a separate file so we can bump it without cluttering the SVN
 */

/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '2.5.1';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB scheme
 * changes.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 7796;

$wpmu_version = '1.5.1';

Math Example:

When I did set up some starter blogs on another platform, I didn’t have anything to post there, and neither did anyone else I set one up for. So they languished, got crawled, and then got spammed. But nobody else noticed, so I deleted those blogs and watched the 404 errors pile up in the web server logs.

So let me know confess my undying love for the goodness that is Spam Karma. Lots of spams eaten, few to none passed onto the actual pages. Most recently caught:

Thank you, “free mp3 ringtones” and “downloadable ringtones”, for your kind words. I tried to make my site nice, and I’m happy that it waw’ed you. “omegax”, who a found me site in google, thanks for stopping by. I think I know “traspoolkae”, a classmate of the nearly-famous Mark V. Shaney.

But most of all, thank you Dave of Unknown Genius. This plugin reduces my daily list of things to worry about by one.

1. Restrict registration to people with email addresses in our subdomain cae.tntech.edu — this would include every engineering graduate student plus a sizable chunk of the engineering faculty, and a few staff.
2. Force blog addresses to be of the form blogs.cae.tntech.edu/username/ , where username is the individual’s designated CAE username. >99% of these match the university’s username.
3. Streamline signup as much as possible. If the user has activated their CAE login account, all they should have to do is enter their username, hit the register button, check their email, and get going.
4. Remove the 4-character minimum on usernames and blog names. Mostly because two of us have 3-letter usernames here.
5. Restrict creating multiple blogs. One blog per user by default — if a working group or project team needs a group blog space, I’ll create it myself.

These patches for wp-signup.php and wpmu-functions.php appear to be working fine for goals 2-5. Goal 1 was already handled in WPMU by restricting the email domains that valid users can sign up from. I’ve not vetted these for blogs in subdomains instead of subdirectories, nor for security. But the changes should be small and simple enough to be easily audited.