It seems like it’s calmed down now, but I had two weird spam interactions this past weekend on my personal site.
The first seemed pretty benign, three comments from webmentions on recent posts saying very nice things. The comments felt believable as people individually, but when I saw a third with the same shape of comment from the same IP as the other two, I knew. The language in the comments felt more genuine because of some typos weirdly enough.
There were no links or anything in the comments themselves, but the “from” websites in the mentions led to Playstation-themed blogs with I assume malicious links. In looking up the IP address, it had been reported as a spammer on various services.
The second seemed much more like an attack. Repeatedly for about 48 hours, two different IP addresses posing as many different accounts were using “trackbacks” (an older Indieweb comment format), to comment “Buy [medication] in [country/continent] at [link].”
Where I got three in the other batch, this set left 1,117 comments in total over about 54 hours. The final six hours were being auto-moderated once I limited the IPs and keywords. From this set there was what I think was a test post on Thursday morning and then the spam started in earnest on Saturday.
