I have my own comment system with some rudimentary spam protection. Recently I started getting a few comments that appear to be automated with the name "XlsUoIGh" and the content "doors.txt;10"

I deleted the first set of comments, thinking it was probably nothing. However, they came back. They're constrained to one page and usually only 2 or 3 are posted. I've heard online that this text serves as a "bookmark" for future spammers to find and use. Is this true? I've also heard of similar pieces of content being posted like "door.txt;6" What does the number mean?

1 Answer 1


Things like that are test strings used by spam bots to verify if your commenting system is susceptible to attack. If your commenting systems displays the message bot instantly marks it as target. Additional checks are often made later on to see for how long did message last, and if your site still can be targeted.

Best prevention method would be either to use some form of basic CAPTCHA (not necessarily reCaptcha, as it was cracked several times already and currently is one of most frustrating captchas for end-users), or user tracking through session (eg. you cannot write message in under 10 second from loading the page) - perhaps with additional "blacklist" of words that will forbid posting the message.

It's not 100% secure, but definitely will discourage most of basic spambots (it won't defend you from a directed attacks though.

  • Well, currently I have a basic honeypot system with no intentions of adding a captcha. I guess it'll just have to be smarter about it
    – Earlz
    Feb 13, 2013 at 15:41
  • As said - probably the easiest way is to use session data to store $_SESSION['lastPageLoadTimestamp'] with time() and then when posting comment - compare it with current time stamp. If the difference is below 10s you should be free to pop an error. Either someone attempted to write something meaningless or is a spam bot, as there's no way anyone would load the page, read at least one paragraph of content and than post meaningful response in below 10s. Meanwhile spambots rarely wait more than 5s before posting (usually they just load and instantly post message for maxed efficiency). Feb 13, 2013 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.