Akismet Tips

[bbrez1]

I'm tired of people writing random shit about why someone's comments aren't getting accepted. I made a simple script that would let me experiment and check if the comments were spam instantly (without WP). Here are some akismet tips for you:

Names
- They never get banned! You can use the same name on millions of submissions and it won't get banned.

Emails
- Also like names will never get banned.

Websites
- Get banned quite fast.
- When a site gets banned the whole domain get's banned (so you can't use subdomains for example)
- And something that I bet 99% of you did not know before: Anything other than just a domain link will show your comment as spam! For example using this link

http://www.blackhatworld.com/blackhat-seo

Will show your comment as SPAM. It's the same for any other website. It's something more on this but I do not want to share that, for now.

Comments
- Spamming same comments will get your comments banned in 35 - 50 submissions
- You can use comments that are super long and if they get banned you can just change a single char in that comment and it will not be banned.

So basically you can spam posts that are super long and only change a certain character. Like:

Super long comment {.|,|!| .| . |. |..|_|*|?} etc...

A single char changes everything! So what I did is I wrote a longer comment and just use spins on dots and other chars I used in the comment. Works great! You can still use some spins on words here and there but you don't need to spin most of the comment. The above example could be used on about 350 - 500 submissions, and with making a long comment and spinning chars, maybe adding smilies, adding some words, if you want you would get a comment that you will never need to change again.


When one of the 2 things I wrote above is marked as spam your comment will of course show as spam.

I'm still making some research and am learning new exploits daily and already have one which I'm testing that's why I will keep this thread updated with new things I find out.

Let me know what you think.

Thanks

 

[nufaman]

And something that I bet 99% of you did not know before: Anything other than just a domain link will show your comment as spam! For example using this link

Didn't quite understand this

 

[bbrez1]

Didn't quite understand this

What I meant is deep links will show as spam. If you use:

www.website.com <- will not show as spam (if not yet banned)
www.website.com/title-here <- will show as spam

 

[nufaman]

How exactly did you test this? How sure are you of all this?

 

[bbrez1]

How exactly did you test this? How sure are you of all this?

It's basically the same code than the one that it's used in wordpress.

It connects to akismet's API and I can input data and it instantly checks and
return if it's spam or not. So instead of needing to comment on WP blog and
then check in WP admin I made a script that I can input data and it returns
instantly.
I made a lot of tests. Everything I wrote for comments and websites
I am sure is 100% I manually tested about 2000+ submissions. The thing with
names and emails could be that it gets banned at a really huge amount of
submissions but I did not get this before (It would be stupid if they banned
names if you think of it anyway). It could leave some footprints but as
I said I did not see this before.

With this I could now make a checker which would tell someone if his website
or comment is banned.

 

[xhpdx]

And something that I bet 99% of you did not know before: Anything other than just a domain link will show your comment as spam! For example using this link

This is so not true. Tried more than 10 comments on several of my blogs and none were put in the SPAM queue. All went to Pending

 

[bbrez1]

This is so not true. Tried more than 10 comments on several of my blogs and none were put in the SPAM queue. All went to Pending

So did I, I would not be posting this if it wouldn't be true and tested. Believe me

I also forgot to mention that if you post from public proxies your comment will get market as spammed since they are most likely all banned.

 

[xhpdx]

So did I, I would not be posting this if it wouldn't be true and tested. Believe me

I also forgot to mention that if you post from public proxies your comment will get market as spammed since they are most likely all banned.

I guess we'll have to wait for someone else to try and confirm who is right

 

[bbrez1]

I guess we'll have to wait for someone else to try and confirm who is right

Sure. Will wait if someone will test this and tell their results. Well that's why it's shared here anyway . I know it works for me as I did (apart from the huge testing) some smaller SB blast and also checked it on my sites and got the results I wanted.

Just thought I d share, I think it will help a lot to some people, it sure did to me.

 

[cooooookies]

Thanks, bbrez, using the API to check stuff is a good idea. I am also working on seeing where the limits of WP and askimet are. Will post here soon.

 

[bbrez1]

Yes it's super easy and fast. It gave me so many things I never knew about it before, now I'm able to post comments that have super high success rate. Let us know your findings

Thanks

 

[Extropy]

Sure. Will wait if someone will test this and tell their results. Well that's why it's shared here anyway . I know it works for me as I did (apart from the huge testing) some smaller SB blast and also checked it on my sites and got the results I wanted.

Just thought I d share, I think it will help a lot to some people, it sure did to me.

I can confirm that deep content links get flagged as spam for me. Chopping off the deep link and going with just the base URL resulted in the comment going through.

I had made a couple of thousand submits to random URLs (some deep, some not) prior to manually testing it.

I look forward to seeing the rest of your results!

 

[cooooookies]

Want to carefully comment further, since I did for now only some tests.

IP blocked does possibly not mean domain is blocked and vice versa.
using blocked IP ==> does not block for the future your domain
using blocked domain ==> does not block for the future your IP

But again, this is a number game, I would not swear on that and I am currently automating tests. I will comment on that later quantitatively, as soon as I have some more numbers.

Much more important:

In every case we need fresh IPs. I am currently investigating the trick I found on bluehatseo (using/offering nonworking proxy server(web, http), redirecting to another page of mine containing jscript to post with the visitor's IP). Really, I do not see any future in using public proxies and even private proxies are problematic: you have to check them in every case. Own proxies? Too many needed and maybe quickly burnt.

I am not speaking in promoting a single web-page, this is not so spectacular. But what I want is to promote in higher volumes. Currently, apart from botnets which I rather dislike, that proxy trick seems to work wonders.

 

[Stu784]

How can you tell if Askimet has your site listed as a spam site?

Can you do anything to get off this list?

Once you're blacklisted does that mean that you can't ever post a blog comment on any Wordpress site using Askimet?

 

[gregstereo]

Relatively easy - try commenting manually on an akis protected site and see what you get after you click Submit or whatever the button is labeled.

Blank page? "Comment discarded"? Something like that...welcome to the blackhole.

Their API is interesting too, but you have to know what you're doing to leverage it. For now start with the basic tests.

The ban will last as long as Matt Mullenweg wants it to. I suspect there's an element of "repeat offender" and "severity of offences" factored in to the length of your time in the box once you're banned.

I still would like to see more results and details from the OP and others who have done some testing...

 

[sunseven]

Want to carefully comment further, since I did for now only some tests.

IP blocked does possibly not mean domain is blocked and vice versa.
using blocked IP ==> does not block for the future your domain
using blocked domain ==> does not block for the future your IP

But again, this is a number game, I would not swear on that and I am currently automating tests. I will comment on that later quantitatively, as soon as I have some more numbers.

Much more important:

In every case we need fresh IPs. I am currently investigating the trick I found on bluehatseo (using/offering nonworking proxy server(web, http), redirecting to another page of mine containing jscript to post with the visitor's IP). Really, I do not see any future in using public proxies and even private proxies are problematic: you have to check them in every case. Own proxies? Too many needed and maybe quickly burnt.

I am not speaking in promoting a single web-page, this is not so spectacular. But what I want is to promote in higher volumes. Currently, apart from botnets which I rather dislike, that proxy trick seems to work wonders.

Can you please explain in detail the trick you found on bluehatseo (using nonworking proxy server redirecting to another page? Sounds interesting.

 

[Stu784]

Relatively easy - try commenting manually on an akis protected site and see what you get after you click Submit or whatever the button is labeled.

Blank page? "Comment discarded"? Something like that...welcome to the blackhole.

Their API is interesting too, but you have to know what you're doing to leverage it. For now start with the basic tests.

The ban will last as long as Matt Mullenweg wants it to. I suspect there's an element of "repeat offender" and "severity of offences" factored in to the length of your time in the box once you're banned.

I still would like to see more results and details from the OP and others who have done some testing...

I get a blank page

 

[quadratic]

I think that the ops approach is an excellent idea and reverse engineering Akismet, or at least getting a better insight into its workings can only be beneficial for automated blog commenting attempts.

Interacting direct with the API is good for volume testing but it is also worthwhile looking at the operation of the Akismet plugin and how it is used by Webmasters. They are the ones who can review its operation and agree with the spam classification of comments or override this and move a comment from their spam queue to pending or approved.

It is not well known that until Akismet version 2.28 (published a few months ago) the 'spam to ham' function - the process by which a falsely identified 'spam' comment is reclassified as an ok comment was broken. The impact of this on us was that whilst Akismets aggressive spam filtering flagged many comments as spam, they may have been reviewed by site owners and (for the good, well thought through comments) reclassified within the blog as approved BUT the message was never transmitted to Akismet. So once marked as a spammer you would never get out of that pigeonhole as positive votes for your comments were not recorded at Akismet HQ and you would always be classified as a spammer by Akismet and it was not able to receive feedback and learn.

Now the bug has been fixed I have started to see whether a site can be permanently removed from the spam trap by receiving lots of positive votes from other sites.

Checking the php code we can see that the plugin transmits the following information when it processes a blog comment: -

Blog url and the permanent url of the post the comment was submitted to.
User ip plus user_agent
The content of the HTTP_REFERER header
Submitted name for the comment
Submitted email address
Commenter target URL.
The actual content that was submitted.
Other SERVER enviroment variables which can include the proxy IP and your exposed IP if the proxy is not completely anonumous

Experimenting with my blog network linking to a different domain which is always blacklisted by Akismet I have seen that: -
1 If a comment is flagged as spam on one of my blogs and I mark it as ok then a subsequent comment, on the same blog, from the same author name, linking to the same external domain is then auto approved by Akismet - a success!
2 If I repeat 1. above but change the name or email but use the same seperate external domain then the comment immediately falls into Akismets spam queue
3 If I repeat 1. above but make the comment = name + email + domain name on another blog I own the comment still is auto flagged as spam

This could indicate that:-
- The target domain name is a very important part of the spam assessment
- Akismet is taking into account name, email and target domain name in the spam assessment for on a blog.
- Whilst a domain is classed as spam a specific combination of name + email + domain name can be registered as approved and will pass the spam filter on that same blog domain in the future
- When a domain is classed as spam the same specific combination of name + email + domain name previously registered as approved on another blog will not pass the spam filter on a different blog

Now this last point may be overcome once a number of 'positive' votes have been received for that comment combination of name + email + domain name and this needs testing. I have repeated this process 5 times so far but the target domain still falls into the spam trap.

 

[Disposable]

I think that the ops approach is an excellent idea and reverse engineering Akismet, or at least getting a better insight into its workings can only be beneficial for automated blog commenting attempts.

Interacting direct with the API is good for volume testing but it is also worthwhile looking at the operation of the Akismet plugin and how it is used by Webmasters. They are the ones who can review its operation and agree with the spam classification of comments or override this and move a comment from their spam queue to pending or approved.

It is not well known that until Akismet version 2.28 (published a few months ago) the 'spam to ham' function - the process by which a falsely identified 'spam' comment is reclassified as an ok comment was broken. The impact of this on us was that whilst Akismets aggressive spam filtering flagged many comments as spam, they may have been reviewed by site owners and (for the good, well thought through comments) reclassified within the blog as approved BUT the message was never transmitted to Akismet. So once marked as a spammer you would never get out of that pigeonhole as positive votes for your comments were not recorded at Akismet HQ and you would always be classified as a spammer by Akismet and it was not able to receive feedback and learn.

Now the bug has been fixed I have started to see whether a site can be permanently removed from the spam trap by receiving lots of positive votes from other sites.

Checking the php code we can see that the plugin transmits the following information when it processes a blog comment: -

Blog url and the permanent url of the post the comment was submitted to.
User ip plus user_agent
The content of the HTTP_REFERER header
Submitted name for the comment
Submitted email address
Commenter target URL.
The actual content that was submitted.
Other SERVER enviroment variables which can include the proxy IP and your exposed IP if the proxy is not completely anonumous

Experimenting with my blog network linking to a different domain which is always blacklisted by Akismet I have seen that: -
1 If a comment is flagged as spam on one of my blogs and I mark it as ok then a subsequent comment, on the same blog, from the same author name, linking to the same external domain is then auto approved by Akismet - a success!
2 If I repeat 1. above but change the name or email but use the same seperate external domain then the comment immediately falls into Akismets spam queue
3 If I repeat 1. above but make the comment = name + email + domain name on another blog I own the comment still is auto flagged as spam

This could indicate that:-
- The target domain name is a very important part of the spam assessment
- Akismet is taking into account name, email and target domain name in the spam assessment for on a blog.
- Whilst a domain is classed as spam a specific combination of name + email + domain name can be registered as approved and will pass the spam filter on that same blog domain in the future
- When a domain is classed as spam the same specific combination of name + email + domain name previously registered as approved on another blog will not pass the spam filter on a different blog

Now this last point may be overcome once a number of 'positive' votes have been received for that comment combination of name + email + domain name and this needs testing. I have repeated this process 5 times so far but the target domain still falls into the spam trap.

Cool data. Thanks for sharing. I wonder if sufficient auto-approve akismet blogs (yes, I know it's almost an oxymoron) could be found to test the number of positive votes needed.

 

[FrozenSpade]

Always use the homepage.

BTW: You can use 1 link and 1 keyword in your comments and u won't get banned by Akismet. (I tried it with 50k+ blogs).