I have a website with a non-realtime guestbook (people can click the “Post” button and fill in the Subject and Comments fields, and then click the “Send” button, but it doesn’t go up on my site until I review it; and I receive it as an email).
It isn’t compellingly obvious to other people that I review postings before they go up, so lots of folks probably assume/hope whatever they post will just immediately appear and be available to be ready by subsequent browsing folks, and yes abusive comments and spam do show up sometime, but this was different and definitely weird.
This morning I had 3 new guestbook posts. All three of them had an entry filled in for the Homepage URL of the person posting: http://hgdzyjrn.com/llgl/qvei.html
It doesn’t go to anything. Try it. There’s no such freaking domain.
All three of them had for the subject the string “My homepage”.
Two of the three had gmail email addresses, the third had a mail15.com email address. (as with the Homepage URL, these are optional and manually filled in by the poster).
My form has a series of checkboxes — my website consists of academic and semi-academic papers I wrote, and I’m asking which of these, if any, the posters are posting about. The bottom checkbox is a “Specify Other” with a fill-in-the-blank. All three posters input a “specify other” string:
“Marla” specified “Marla”; “Vincent” specified “Vincent”; and “Candice” specified “Candice”.
For comment, “Vincent” input “Great work!” and then repeated the dead/nonworking URL plus a second dead/nonworking URL, http://xojvedlw.com/noqq/masw.html, surrounded by attempted HTML code that would attach the second URL to the clickable string “Please visit”.
“Candice” also input “Great work!” and also repeated the first dead/nonworking URL plus a third dead/nonworking URL, http://royukprz.com/ajov/vnho.html, surrounded by attempted HTML code that would have linked it to the clickable string “Cool site”. “Candace” used vBulletin-style square brackets [URL = “string”] Cool site [/ URL], like that, instead of the HTML-native angle brackets used by “Vincent”.
“Marla”, displaying more individuality, put “Thank you!” instead of “Great work!” and entered the original dead/nonworking URL, a space & pipe character & another space, and a fourth nonworking URL, http://qwhivbps.com/yhil/qefq.html, with no attempt to encode them in a href …/a of any flavor.
Oh, and “Marla’s” (presumably invalid) email address account is “adam”, “Candice” gets her email at “scott”, and “Vincent” receives email addressed to “vicky”.
What do y’all think? Is this a manual effort, to see what would or would not go through and end up on my guestbook? Or is some kind of spambot at work here?
What purpose is there in posting some nonworking URLs to someone’s website guestbook?
(I’ve added hgdzyjrn.com to my email spam filters)
