So the spambots work overtime. I have a "Delete" button for comments and I'm considering wiring the comment system to rspamd so I can have spammy comments sent for review before I allow them to be posted (this will be extremely easy, courtesy of another neat, unintended interaction between how comments work and how drafts work; emergent features are a big part of how you know your architecture is good!), so I'm less bothered and more interested by how and what they're posting.

The how is not that interesting; these are just form submission bots, they have some logic around how to populate the forms (what field is a name, what's the body, etc) but that's it.

Now, the what, that's far more interesting. First off, languages: Only about a third of the spam I've killed has been in English, the rest in Chinese and Cyrillic (I'm assuming Russian). This is not unreasonable but is evidence for how untargeted these things are; I doubt I have any Mandarin or Russian first language readers who would be reached by these, but of course the first principle of spam applies: You can have an astronomical miss rate and still be effective because the marginal cost of a single piece of spam is zero.

The other thing that's even more interesting is the presentation: They use bbcode! The spam is all either plain (UTF-8) text or laced with bbcode markup, which renders as plain text here (because my comments - see the nice little composer! - are 3BMD-flavored markdown with some local custom markup only, although I want to see if I can allow filtered HTML and CSS like Cohost did), so the bbcode posts are completely illegible. Again, it's not a problem for the spammers because it's just shooting in the air and hoping to hit something, but it says something about how common bbcode still is.