Empty Or New Blogs Can Be Classified As Spam Hosts

We're seeing a few recent reports, in Blogger Help Forum: Something Is Broken, from owners of empty and / or new blogs, about spurious spam classification.

Very few owners of empty or new Blogger blogs understand why their blogs should be classified as possible spam hosts, by the Blogger anti-spam processes. Most blog owners seem to think that only blog content is considered, in spam classification.

Spam classification considers many characteristics of a Blogger blog, in classifying any blog as a possible spam host.

Blog post content is an obvious - but not the only - factor in spam classification. Given previously observed behaviour of spammers, many characteristics of blogs, besides simply the extracted and analysed content, are used in classifying possible spam blogs. Using fuzzy spam classification techniques, one might also consider

• Accessories and decorations, on the blog.
• Addresses used, in setting up multiple blogs.
• Overall behaviour in Google, by the owner.
• Past posting habits of the owner.
• Previous classification of similar blogs.

Some spammers obscure their activity, with gratuitous Google activity.

Some spammers are active in multiple Google activities and features. It's possible that some spammers even try to make their spam in Blogger harder to detect, by spreading their activity across other Google services - even when non abusive in other Google services.

Some spammers may not realise that activity in other Google areas can be tracked, and included by Blogger spam classifications processes.

Blog publishers, enjoying similar activities, may be spuriously classified.

Blog owners who use one or more techniques involved in setting up and maintaining spam blog farms may be classified as spammers - and their blogs then classified as possible spam hosts.

The term "blog owner" must itself be considered fuzzily, as some spam blog farms contain blogs owned by multiple Blogger accounts and profiles. Some Blogger accounts, similar to known spammer accounts - even with no blogs owned, or with empty blogs published - may then appear as possible spam hosts.

Empty blogs may still provide clues, which suggest spammy purpose.

Empty blogs, that appear similar to blogs in known spam farms, may themselves be classified as possible spam hosts. Various details such as blog name, blog design, and use of various blog accessories and features, can make a blog appear similar to known spam blogs - with no other content.

As long as spammers exist, some Blogger blogs will be spuriously classified.

Given the need for Google to reduce the volume of spam blogs, fuzzy spam classification might use any of the above details, in classifying any empty or new blog as a possible spam blog. This will, unfortunately, lead to spurious spam blog detection.

The possibility of spurious classification cannot prevent classification, in general.

Given the ability of spammers to publish multiple blogs in the Blogger name space, classifying empty and new blogs is necessary, in making it possible for Google to keep up with spammy activity. This technique enables publishers of genuine blogs to have their blogs viewed as righteous Internet content - not as one more blog, in a sea of spam.

Read More

Country Code Aliases Cannot Be Bypassed

Occasionally we see the innocent query in Blogger Help Forum: Something Is Broken, about the recently introduced Blogger feature - country code aliasing.

Is there any way I can opt out from this constantly changing of the .com termination, into .be, .bg, or .ro, depending on where I travel?

Not many Blogger blog owners realise the benefits of country code aliasing, which is, like auto pagination, a feature which is not optional. There are publicly available workarounds, which may bypass the effects of country code aliasing - and which may cause more trouble than simple URL confusion.

Many spammers would love to setup gateway blogs, and automatically redirect their unwitting victims.

Spammers would redirect traffic to dangerous blogs and websites.

The redirections would lead to other blogs (or non Blogger websites) which contain their actual hacking, porn, or spam payload. Blogger / Google, like some browsers and security programs, actively prevents automatic redirection of Blogger blog traffic.

Blogger malware classification is not understood by everybody.

Not all blog owners understand the effect of Blogger malware classification. Similar to spam classification, malware classification persistently scans through Blogger blogs, looking for signs of malware.

Anti-alias redirection code is very simple, and subtle.

Here's an example - a very simple code snippet, recently discovered in the header of the template, in a blog which has been repeatedly locked for "Malicious JavaScript" / "Spam".

var·blog·=·document.location.hostname;
var·slug·=·document.location.pathname;
var·ctld·=·blog.substr(blog.lastIndexOf("."));
if·(ctld·!=·".com")·{
var·ncr·=·"http://"·+·blog.substr(0,·blog.indexOf("."));
ncr·+=·".blogspot.com/ncr"·+·slug;
window.location.replace(ncr);
}

or maybe, a more compact snippet

if ((window.location.href.toString().indexOf('.com/'))=='-1') {
window.location.href =window.location.href.toString().replace('.blogspot.in/','.blogspot.com/ncr/').replace('.blogspot.com.au/','.blogspot.com/ncr/');
}

or maybe

//<![CDATA[(LF)
var·curl·=·window.location.href;if·(curl.indexOf('m=1')·!=·-1)·{curl·=·curl.replace('m=1',·'m=0');window.location.href·=·curl;}(LF)//]]>

To prevent malware detection from blocking this post, I'm omitting the essential opening and closing tags, which would normally encase the above code snippets.

<script·type='text/javascript'> ... </script>

You can try anti alias redirection code, if you like.

If your blog contains similar redirection code, to bypass country code aliasing, you may get a notice, one day, that your blog has been deleted for "Malicious Javascript". In order to get the blog restored, so your readers may view it, you may have to remove the Malicious JavaScript - then wait until the blog can be reviewed, to ensure that it is safe for public visibility.

When your blog is classified as a malware host, you will suffer.

While you wait for review, you will have to endure the loss of search engine and reader reputation - while every would be reader sees the interstitial notice, mentioning why your blog is deleted or locked.

Work on the problem, don't use (and encourage) dodgy workarounds.

You will accomplish more, and cause yourself (and your readers) less pain, by learning to live with country code aliasing - and concentrating on convincing the various search engines and other Internet services to accept Canonical URLs, so country code aliasing will work, seamlessly, with the Internet service which interests you. Alternately, use better designed gadgets and Internet services.

Read More