Coyotes, Hyenas, And Turkeys

The 1978 cinema classic "Animal House", which starred the late, great John Belushi as John Blutarsky, was a comedy about American 1960s college life. It was described by one reviewer as

the best college comedy ever made. Nothing has ever come close to comedic perfection, and never will again.

It focused on one fictional fraternity, Delta House, the rejects of the campus fraternity system at the college.

The members of Delta house included screaming nuisances (coyotes), troglodytes and trolls (hyenas), and hapless morons (turkeys). Many inhabitants of Delta House, many years later, can be found as bloggers, posting in Blogger Help Forum.

Coyotes are individuals who, unhappy with the way they are treated by Blogger, convince the general public (their reader population) to conduct a Distributed Denial Of Service attack against the forum. The owners of their namesake blog, The Daily Coyote, conducted a DDOS in April 2008, when it was locked as a suspected spam blog.

Hyenas are individuals who lack self esteem or social life and who post endless amounts of crap, drivel, or lame spam in the forum. Coyotes conduct a brief and very energetic attack, yet they cease the attack when dealt with, firmly. Hyenas, on the other hand, conduct a slow, chronic attack over many months. One hyena has posted under many names, and has been attacking the forum for several years.

Turkeys are spammers who refuse to believe that their splogs, detected and locked by Blogger, will never be restored to them. They hang around Blogger Help Forum, periodically posting

When will I get my blog back?

as if Blogger will ignore the fact that their blogs were righteously detected and locked.

Welcome to Animal House, 2009.

>> Top

Waiting For The Tap On The Shoulder, Part 2

In my musings last month about spam blogs, and people victimised by spam blogs, I analogised the legendary college secret societies, and the impersonal and rude treatment of the unfortunates who did not get initiated.

eventually, those who don't get elected will open their eyes, remove the blindfold, and find herself / himself in a pitiful group of rejects, all waiting (hopelessly) for that tap. The tap that never comes.

Again, I'll note that I never got into either group.

I am not socially adept enough to even try out for such a group. Or maybe I simply had other priorities.

This month, we are seeing the unfortunates, gathered in Blogger Help Forum.

In college, there will always be those do-gooders who try to change peoples minds, and convince the secret society members to be more polite to the unfortunates. Maybe, they could have a party to thank them for trying.

These "unfortunates", this month, are spammers. They aren't worthy of our pity, or sympathy.

They are the reason why you had your blog locked, last week.

• If you had to wait, while your blog was offline and lost reader contact, and search engine reputation;
• If you had to endure another mention of the hated 4 step protocol (that you repeated 3 times);
• If your blog lost page rank because of duplicate content penalties;

these are the people that you should blame. Here, we will call these folks "turkeys".

Gobble, Gobble.

Maybe It's Time To Start Over

I've been advising folks about spam problems, and splog detection (both righteous and spurious), for several years.

Sometimes, the advice is about cleaning up the blog, and submitting it for review. Other times, it's about blogs unjustly accused of being spam. Occasionally, it's about a spam blog, that just can't be reviewed again, or maybe a old blog, that you just can't regain control.

If the Blogger region of the Blogosphere is to have any reputation, other than "spam haven", it's simply not possible to provide an infinity of chance for people to clean up their act.

this is what i got from email:

We'd like to inform you that we've received another complaint regarding your blog. Upon review of your account, we've noted that your blog has repeatedly violated Blogger's Terms of Service (http://www.blogger.com/terms.g). Given that we've provided you with several warnings of these violations and advised you of our policy towards repeat infringers, we've been forced to remove your blog.

Once forgiven, you still start over from the beginning.

We all believe in forgiveness, but having been forgiven, should you continue with the blog restored and simply cleaned up? Or maybe, isn't it better for everybody if you simply start over, with a new blog and new content?

And if you publish your blog, you want your blog to remain your blog. Just as we cannot give spammers an infinity of chances to pollute the Blogosphere with their blogs, neither can we give them the chance to steal already developed blogs, using brute force and an army of hijacked computers.

Everybody who wishes to publish a Blogger blog has to religiously maintain control of their Blogger accounts - both by not forgetting access tokens, and by not idly allowing unknown persons to seize control.

If you lose control of your Blogger account, don't demand that Blogger Support blindly tell you what you require, and possibly violate your right to anonymity.

Start a new blog - and don't repeat past mistakes.

Focus your energy on starting a new blog - and maybe connecting the new blog to the old blog. Don't waste your time (the helpers time, Blogger Support's time) trying to clean up what can't be cleaned up, or demand that Blogger help you to seize control of a blog which could be (to them) someone else's blog.

Start over, but with a clean blog - and try to avoid repeating your mistakes.

Learn to read - and heed - the warnings.

Next time, when you get the first notice about unacceptable content, heed the warning. And when you change ISPs (get a new job, graduate from school, whatever), and you get a new email address, update your Blogger account - while you can.

The Attack Of The Clones

One noticeable spam problem became visible in late 2009, thanks to yet another Blogger error.

This error left a lot of bloggers (some legitimate and others actually spammers) reporting both confusion and indignation.

The confusion was seen, in two (seemingly) separate topics of indignation.

My blog seems to be locked, but when I fill out the CAPTCHA, I get

Your blog is not locked, and does not need review.

What do I do, now?

and

My blog is not spam! Honestly, how could Blogger legitimately call my blog spam?

Both of these reports, echoed by dozens of bloggers and spammers, show two sides of the same story.

The first report was typically about blogs that were righteously locked - yet a mistake caused the message

Your blog is not locked, and does not need review.

The second report exemplifies the despair and frustration felt by thousands of honest people who simply want to publish to their blogs. And there are dozens of similar, and dissimilar reports.

Note: This isn't fiction - I'm not stealing content from the Tom Clancy "Net Force" novels. This is real.

Spammers publish new blogs, constantly, using botnets.

Spammers, in order to publish one or two active splogs (blogs containing actual hacking, porn, and / or spam content), use the power of the Internet. Each splog publisher ("splogger"), who may have at his control thousands of hijacked computers, publishes thousands of blogs each day.

A spammer starts with empty blogs, which do not appear spammy.

A splogger starts by simply publishing empty blogs, in a constant, all day activity. You may see the empty blogs some time, if you go "Next Blog" surfing. They have a title, an archives gadget in the sidebar, and maybe one or two posts with random garbage. And a Profile gadget, with a link to the "owner", each "owner" with 10 blogs.

He then adds random content, scraped from the web - maybe, from your blog.

The splogger next takes one legitimate blog - in this case, your blog. He scrapes content from your blog, takes a dozen or so of his empty blogs, adds your content to each, and republishes each blog. Now, there are a dozen clones of your blog, plus your original, in BlogSpot.

He then adds spammy content, to a few of his blogs.

Next, the splogger takes a couple of his recently created clones, adds the payload - hacking, porn, and / or spam content, or possibly, links to other blogs or websites containing the payload - and republishes his now active splogs.

Each time, he just uses a couple blogs (cloned from your blog), and keeps the others as reserve. He has dozens of other splogs with active content out there too, using content scraped from other legitimate blogs. The clones of your blog, joining the clones of other blogs, are now active members of his splog farm.

As Blogger deletes discovered spammy blogs, the spammer uses more like yours.

As the splogs with active content are detected and removed by Blogger, the splogger simply activates other reserves, placing payload into each, in turn. By the time all of the reserves, that are clones of your blog, are used up, the well designed spam blog farm will have clones of still more legitimate blogs, ready to be activated.

A spam blog has a distinctive life cycle.

Considering this process, we see the 5 Stage life cycle, of each blog in the splog farm.

1. Empty (just published).
2. Reserve (previously empty, republished with scraped content added).
3. Active (previously reserve, republished with payload added).
4. Detected (previously active, locked by the Blogger Spam Classification bot).
5. Deleted.

The plan here is that each splog will pass through each stage in the life cycle, in proper sequence. Since the splogger publishes thousands of splogs daily, if Blogger were to simply lock then delete the active splogs, the splogger simply activates the reserve splogs, as needed. This is good project management, by the sploggers.

Blogger shortens the life cycle, using fuzzy blog identification.

Blogger aims to shorten the splog life cycle. When the anti-spam bot detects an active splog, they search their database of suspected splogs, find similar blogs with no active content (the reserves), and lock the reserves too.

Unfortunately, when Blogger locks the reserve splogs, they are also going to lock your blog. Fuzzy spam detection techniques can't tell the difference between your blog, and the clones, because there is no difference.

If a spammer clones your blog, your blog will look just like a spam blog.

A successful clone is a non distinguisable replica of the original blog. Your blog looks like one of the reserve splogs. This leaves you, and bloggers like you, reporting

My blog is not spam! Honestly, how could Blogger legitimately call my blog spam?

If the spam blogs went untouched, the search engines would index your blog.

When you look at this differently, though, you see that Blogger is actually helping you. Were your blog, and the clones, to remain in BlogSpot undisturbed, the search engines would see the clones, and levy a huge duplicated content penalty on all aliases of the content - including your original blog.

If you are able to declare your blog as legitimate to Blogger, Blogger can later delete the sploggy clones - and the search engines will, hopefully, continue to index your blog, as legitimate and unique content.

In 2012, Blogger took the Next Step, and made "Next Blog" a less productive launching ground for splog farms. With blog owners carelessly deleting and renaming their blogs, however, the blog clone farm continues as a useful model for spam distribution.

Waiting For The Tap On The Shoulder

I'll be honest here. I was a nerd in college (and I am one even now).

So this story is one that I've only seen in movies - neither I, nor my friends, got even this far.

College Secret Societies
Some of them have no name even. There are no published entrance rules - membership is by invitation only, and rules are communicated by word of mouth. And the initiation process starts like this:

• The prospective members are blindfolded, and led to a dark room.
• The prospective members are put into a circle, in silence.
• The prospective members wait, for what will happen, they are told nothing.
• Periodically, one prospect will feel a slight tap on the shoulder. In silence, he / she will be taken by the hand, and led into another room where they will join the elite.
• And eventually, those who don't get elected will open their eyes, remove the blindfold, and find herself / himself in a pitiful group of rejects, all waiting (hopelessly) for that tap. The tap that never comes.

Now maybe you should be advised that this article is a rehash of one that I wrote long ago, about a more pleasant and positive experience.

The subject of this narration is the spam detection problem of this week. So, here are my words of wisdom about this mess.

This problem is caused by criminals - spammers who are publishing thousands of spam blogs, daily.

They make dozens of clones of your blog, by scraping the content from your blog, pasting it into their blogs, and adding the spam content to just a few of their blogs, at any time. Blogger can't tell the difference between the spam blogs without active content, and your blog. So all of the blogs that look like your blog - including your blog itself - get locked.

If you are not a spammer, look at the next guy (also reporting the problem), because it's likely that he is one. And when you get concerned about how long it's taking Blogger to restore your blog, if your blog is not a splog, place some blame on the spammers, and the thousands of splogs that have to be locked, then reviewed, daily.

Anyway, the only thing that makes this even endurable is the thought of the spammers who have lost their blogs this week. Many of them are gathered in Blogger Help Forum, reporting their blog loss. Some of those gathered in BHF are not spammers - and that is what will give hope for everybody gathered there.

Now Blogger, being the "secret society" in this analogy, will restore a few blogs - the ones that were not splogs. But they will not be posting a big notice.

The following blogs were determined to be spuriously locked, have been restored, and we apologise to their owners.

and conversely

The following blogs were righteously detemined to be splogs, and will never be restored.

Nope.

Blogger will walk around silently, and tap the owners of the spuriously locked blogs on the shoulders. Those owners will wake up one morning, and their blogs will be back, operational.

The spammers will be the ones waiting, until they figure it out on their own, that they will never get the tap. They will wait all night, then slink home in silence.

BooHoo.