XRumer

XRumer

Stable release	7.0 / 12/10/2010
Preview release	7.0 / 01/10/2010
Operating system	Microsoft Windows
Available in	English, Russian, Czech, German, Polish
Type	Automated forum/blog/guestbook posting Tool
License	Proprietary
Website	www.botmasterlabs.net/xrumer/?p=12-0-11-Elite

XRumer is a Windows blackhat SEO program that is able to successfully register and forum spam with the aim of boosting search engine rankings. The program is able to bypass security techniques commonly used by many forums and blogs to deter automated spam, such as account registration, client detection, many forms of CAPTCHAs, and e-mail activation before posting. The program utilises socks and http proxies in an attempt to make it more difficult for administrators to block posts by source IP and features a proxy checking tool to verify the integrity and anonymity of the proxies used.

In addition, the software can avoid the suspicions of forum administrators by first registering to make a post in the form of a question which mentions the spam product ("Where can I get...?"), before registering another account to post a spam link which mentions the product. The side effect of these innocent-looking posts is that helpful forum visitors may search on a search engine (e.g. Google) for the product and themselves post a link to help out, thus bolstering the product's Google stats without falling afoul of forum posting policies. The software is also capable of avoiding detection by making posts in off-topic, spam and overflow sections of forums thus attempting to keep its activities in high activity low content areas of the targeted forum.

Xrumer is capable of posting to blogs and guestbooks in addition to its main role as an automated forum posting tool, it can also create forum profiles complete with signature in an attempt to boost search engine rankings without alerting forum administrators with any off topic forum posts. The software is also able to gather and decipher artificial intelligence such as security questions (i.e what is 2+2?) often used by forums upon registration.

Hrefer is also included. This software is used to automatically parse results from search engines including Google and Yahoo for forums and blogs that can then be used as a target list for the main XRumer application.

According to The Register, as of October 2008, XRumer can defeat CAPTCHAs of Hotmail and Gmail. This enables the software to create accounts with these free email services, which are used to register in forums that it posts to. XRumer also posts slowly initially, in an attempt to avoid detection by posting unnaturally fast.

XRumer by default fills in every password field on a page, including those that are hidden. This has been discussed as a method of detection and blocking.

External links

• Brian Krebs (8 January 2007). "Scary Blogspam Automation Tools". Washington Post. Retrieved 2007-01-13.
• "Malware targets bloggers". ITweb. 3 August 2007. Retrieved 2007-08-30.
• Xrumer Russia Official website in Russian
• Xrumer Official website in English