Spammers Take Scripts To User-Generated Sites