XRumer is a piece of software made for spamming online forums and comment sections. It is marketed as a program for search engine optimization and was created by BotmasterLabs. It is able to register and post to forums (forum spam) with the aim of boosting search engine rankings. The program is able to bypass security techniques commonly used by many forums and blogs to deter automated spam, such as account registration, client detection, many forms of CAPTCHAs, and e-mail activation before posting. The program utilises SOCKS and HTTP proxies in an attempt to make it more difficult for administrators to block posts by source IP, and features a proxy checking tool to verify the integrity and anonymity of the proxies used.
In addition, the software can avoid the suspicions of forum administrators by first registering to make a post in the form of a question which mentions the spam product ("Where can I get...?"), before registering another account to post a spam link which mentions the product. The side effect of these innocent-looking posts is that helpful forum visitors may search on a search engine (e.g. Google) for the product and themselves post a link to help out, thus bolstering the product's Google ranking without falling afoul of forum posting policies. The software is also capable of avoiding detection by making posts in off-topic, spam and overflow sections of forums, thus attempting to keep its activities in high activity low content areas of the targeted forum. However, there are other platforms used to spam to, which includes website comment spam.
Method of operation
XRumer is capable of posting to blogs and guestbooks in addition to its main role as an automated forum posting tool. It can also create forum profiles complete with signature in an attempt to avoid alerting forum administrators with any off-topic forum posts. The software is also able to gather and decipher artificial intelligence such as security questions (i.e. what is 2+2?) often used by forums upon registration. Since the latest version of XRumer, the software is capable of collecting such security questions from multiple sources and is much more effective in defeating them.
Helper program Hrefer is also included. This software is used to automatically parse results from search engines including Google, Yahoo, Bing and Yandex for forums and blogs that can then be used as a target list for the main XRumer application.
According to The Register, as of October 2008, XRumer can defeat captchas of Hotmail and Gmail. This enables the software to create accounts with these free email services, which are used to register in forums that it posts to. XRumer also posts slowly initially, in an attempt to avoid detection by posting unnaturally fast. Between 2009 and 2011 XRumer no longer recognized Hotmail and Gmail captchas due to a change in captcha format. Users of XRumer could only defeat such captchas utilizing external human captcha services.
Defenses
Webmasters of topical forums face an ongoing battle against XRumer software, users of which are almost always in violation of forum terms of service, and/or have no interest in the actual forum topic. The users of the software have created an entire industry whose sole purpose is to protect internet sites against users of XRumer. Forum administration tasks against XRumer are often a constant, daily effort, which include identifying new user accounts that are from XRumer users, deleting posts/threads created by the software, and deleting/disabling the user accounts.
The easiest method to defeat Xrumer is to simply require the first post of any new forum member or blog poster to be approved before it can appear. There are several resources that help block forum spam, which reference reports of forum spam by username and IP address. If a user/IP has appeared in the site's lists, it is highly likely that it is a black-hat user of XRumer. Common defensive actions by webmasters are to institute IP-based posting bans on subnetworks used by the spammers.