How to spot a stealth spambot

[Dork]

We've been getting a lot of spambots lately that don't actually post any ads. The format is usually like this:
Bot registers using a compound name such as "manicmelanie"
A day or so later, the bot posts an innocuous looking post along the lines of "Hey, I'm new here and just wanted to say hi!"

The way I can usually tell for sure it's a bot is to do a google search on the screen name. If it's a bot, the search will return many, many hits. Most or all of these are user records on php-based forums with either no posts or just one post identical to the one here.

At that point I generally delete the message and any replies, unless the replies were amusing and I feel like leaving them around.

I don't know what the point of these posts are, but I suspect they have something to do with identifying message boards that are vulnerable to the scripts so that further attacks can be run.

[AntiM]

Thanks, I needed that.

[Toolmaker]

I don't know what the point of these posts are, but I suspect they have something to do with identifying message boards that are vulnerable to the scripts so that further attacks can be run.

Thats possible.. they could also be to help make the acct look legit. Most boards kill linkfarmer accounts due to the disgusting nature of the commerce often contained within the profile. Having a post that makes it look like a real person keeps the commerce contained in the profile www link around a little longer for google to have in the stats. IMHO these bots are LAME. I gotta wonder do these fuckers ever sell any pills with all this BS they go through?

[AntiM]

With these, there often is no www link. Too easy.

[spectabillis]

excellent forensics herr doktor!

[phil]

Are they spambots testing for weaknesses or DDoS bots testing for weaknesses?

[spectabillis]

spambots are usually site oriented, distributed attacks are more protocol based. there are hybrid approaches like hacking smtp but ddos really refers to something different.

[Dork]

We did get hit by a denial of service attack a couple of years ago, which is why we now have that 5 second delay between searches. I don't think these are directly related to that type of thing, but the signature left by these bots could be used to identify php forums.

I think it's probably more like one of these:

[spectabillis]

i picked up a couple of those while walking through the woods, they like to get all tangled up in your hair and when you try and yank them they shoot this light thingy that stings like mad.