Blog Comments – Analysing 100,000 Comments and Spammers

“Nice blog, thanks for the info”

“Awesome site. Great job”

“You should take part in a contest for one of the best blogs on the web. I will recommend this site!”

I know you like flattering comments on your website. And I know you love to see many comments on each one of your posts (say you community participation). Who doesn’t, right? We love them too.

So we decided to take a closer look at the last 100,000 (well, 98,238 to be more exact) comments that were sent to the network of sites that we are monitoring. How much of them are spam? Who are the most annoying spammers? And things like that.

Comment Analysis

We filtered the latest 98,238 comments received (that’s less than a week worth of comments), and ran them through our analysis engine. Guess how many of them were spam? How many were good?

  • Spam comments: 79,858 (81.2%)
  • Good comments: 18,380 (18.8%)

Wow! So according to our analysis, more than 80% of the comments were classified as spam. We even took a conservative approach and classified unsure comments as good comments. So out of every 5 comments received, only 1 was valid.

*Unsure comments were ones we only saw hitting one web site, but the content was suspicious. Those in this list were almost 10,000 (9% of the overall total). If we had classified those as spam, the number would have grown to 90+% spam.

Spam Analysis – Messages

This really amused us. What type of message do you think a spammer was sending? Most of the time, we noticed that they sent a flattering note to increase the odds of the webmaster accepting the comment. Here are the top 10 messages sent by spammers:

The last one in the list is the funniest (“You should take part in a contest for one of the best blogs on the web. I will recommend this site”). Taking out the Viagra and the Louis Vuitton spam, why do they do it?

They do it because in the URL field, they add a link to their own web site (which can increase their page rankings, visitors, etc). Example:

[author] => Mary Jane
[email] =>
[url] =>
[comment] => Good share! I hope more people will discover your blog because you really know what you’re talking about. Can’t wait to read more from you

Spam Analysis – Emails

This email analysis was not as useful as we would have hoped. The emails are very random and mostly from gmail and hotmail accounts. These were the top spammer emails:

470 [email] =>
222 [email] =>
175 [email] =>
172 [email] =>
167 [email] =>
161 [email] =>
136 [email] =>
133 [email] =>
132 [email] =>
129 [email] =>
123 [email] =>
121 [email] =>
120 [email] =>
120 [email] =>
120 [email] =>
115 [email] =>
115 [email] =>
113 [email] =>

These were the top domains used by spammers:


Spam Analysis – URLs

Now it is getting useful, let’s see the domains that are using comment spam to increase their ratings and visitors. Top 30 on this one (out of 24,976 different URLs):

1163 [url] =>
1114 [url] =>
677 [url] =>
481 [url] =>
344 [url] =>
332 [url] =>
317 [url] =>
314 [url] =>
254 [url] =>
225 [url] =>
208 [url] =>
208 [url] =>
202 [url] =>
197 [url] =>
193 [url] =>
190 [url] =>
187 [url] =>
187 [url] =>
179 [url] =>
172 [url] =>
167 [url] =>
161 [url] =>
150 [url] =>
146 [url] =>
144 [url] =>
132 [url] =>
129 [url] =>
127 [url] =>
126 [url] =>

Spam Analysis – IP Addresses

To finish, some actionable information for hosting providers and website owners. This is the list of IP addresses sending the most spam so you can block them out:


The total list is very big (12,190 unique IP addresses), but blocking the top ones is a good start.

Spam Analysis – Countries

Out of curiosity we decided to check the top Countries sending spam (based on the IP address):

23,899 United States (31%)
16,888 China (22%)
5,145 Russian Federation (6.7%)
3,291 Brazil (4.3%)
3,094 France (4.0%)
2,850 Germany (3.7%)

In the olympics of SPAM, the USA is #1, followed by China (Silver), Russia (Bronze) and Brazil.


Yes, there is a lot of spam out there. I would say that 9 out of 10 comments are spammy in some way (even if not automated – we only classified automated messages as spam). In any event, let us know if you want any more information from this list. We have raw data, so we can run numbers and different analysis as requested.

About Daniel Cid

Daniel B. Cid is the Founder & CTO of Sucuri and also the founder of the open source project - OSSEC HIDS. His interests range from intrusion detection, log analysis (log-based intrusion detection), web-based malware research and secure development. You can find more about Daniel on his site or on Twitter: @danielcid

  • Daniel

    Thank you very much! (couldn’t resist it :D)

    • K Nilsen

      Yup, you know it-, just like I’ve been saying.


  • Whalebot Helmsman

    16514 **
    2038 **
    You have 2 gmail domains may be some error?

  • This was pretty much my experience when I had comments turned on. If anyone is looking for a good Spam Plugin that you might not have heard about try NoSpamNX. I had good results with it.

  • More then 80% people are doing the spamming that is very huge number. I never realize that it would be this huge number. Specially the % coming form US is very high…

  • The kitsucesso one spams my site CONSTANTLY. Very grateful for the IP list, hopefully it helps!

  • 001faren

    used servers says,
     MikiPro Ltd specialises in “Ex-Demo” and “Ex-Lease” IT equipment. Your IT needs are we bear you covered.Data backups and security we will be able to experience your needs.You are looking in lieu of on-site hardware and software repairs/maintenance, servers spanking or minute supply, attendant parts, attendant support, minute supply laptops and desktops, or very soon data backups and security we will be able to experience your needs. Please visit our place and knowing many more in lieu of Miki pro

  • TK Knight

    Wish I found this post a few months ago, because this really is an extremely annoying problem. I found this site when I did a “who is” search on one of the url’s you listen as a top spammer (the very first one on the list, actually). Since I’m familiar with some of the other url’s you listed, I’m going to try the above suggestion about blocking the top IP addresses that keep sending this nonsense. I really get tired of having to go through my account just to clear out meaningless crap sent by random people. Thanks to them, I have my account set so that I have to approve ALL comments made *eye roll*. Such a hassle.

  • Jesusdeavila

    Muchas gracias por su trabajo de investigación y su publicación, ahora tiene sentido el comportamiento que he venido observando en un buen los comentarios recibidos. Estoy convencido de que existen más UTL addresss desde donde están enviando comentarios. Le escribo este comentario en español coo prueba de que NO ES SPAM. Muchas gracias. Jesus de Avila

  • Annopost

    wow! what a amazing blog..  to bad three other people have ruined my joke 😀

  • weddings salon

    Ich würde mit Ihnen
    muss hier überprüfen. Welche ist nichts,