Spammers in livejournal

[robbat2]

I'm not sure what's with the sudden wave of spammers hitting livejournal. However they are using some smarted behavior now.

They came to my attension as their spam engines are taking some comments or posts, using them as input data for google, and then using the google results for posting their comment. it's statistical noise, but it's exactly similar to the input noise, so it's beating Bayesian analysis as well.

Real:

There is, really, no difference between people stuck in poverty, unless it's a matter of degrees.

Spammer:

It's a matter of degrees, and while I think those degrees matter let's not pretend lawful companies are much better.

From a discussion about LDAP lookup failures:
Real:

There is actually a user and group for trousers. Also gentoo tends to like certain id/groups as certain UID/GID. If that group is used it will then user the next available GID/UID. Sometimes through later upgrades this becomes an issue. Usually badly written ebuilds. That is why I let the script make it.

Spammer:

Of course, not all, but many ebuilds are plainly badly written or gives bad implementations. One example, I update my OpenLDAP setup.

Yesterday:
gemmawasyl
dorottyaniqof

In a wave, over the last 3 hours:
amandafedij
bridgetuhimo
kaileymuseq
katyajuxek
annabellehusiq

Patterns:

They have a single post, with a large block of filler text from somewhere totally random. Followed by a bunch of links with pornish titles, and matching the following pattern:
RANDOM = appears to be foreign dictionary words
CC = belgique, espana, france, quebec, suissse
TLD = .com, except for espana, which is under .es
WORDS = title words for porn stuff, no spaces
http://${RANDOM}.i${CC}.${TLD}/${WORDS}.html