Suggestions for stopping form spam on websites?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 14 May 2007 Posts: 8

As an afterthought to my post below I wonder has anyone good ideas for combatting form spam.I do have a website and must get about 20 a day on top of all the other junk.Have try relocating the form page url but they catch on quick.I can't afforf to miss an email so the usefullness of filters is limited I feel.

Changed subject title. TS

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Gary,
Did you mean to post this as part of an ongoing thread?

Hello I'm New here! Joined: 14 May 2007 Posts: 8

no not really.
It doesn't really apply to this forum I know (have asked about it elsewhere but found no really good answer)
Just thought a busy forum on scams might have posters with that kind of experience.

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Quote:

As an afterthought to my post below I wonder has anyone good ideas for combatting form spam.

Ok; this bit confused me, since there wasn't a post below.

I'll move this to Gen Chat- I'm sure somebody will have helpful suggestions.

** SUSPENDED ** Joined: 26 Mar 2005 Posts: 1267

Depends if a bot is doing it. Why not add a word verification they must type in to be able to submit something? Like such..

Posted: Tue May 29, 2007 3:11 pm

There's two basic strategies to avoid form spam that I'm aware of: a) You look for strings that would typically identify a spammer or b) you ask for user input (a string of characters or the answer to a question) that an automated script wouldn't know (see nutjob Radden's post above).

I usually opt for b) because it quite effectively sorts out spammers (they will usually never get numeric ZIP codes right or they will usually have html-code in their fields) and saves you the hassle of dealing with users that are too thick to deal with option b).

Basically you run your desired form fields through an "if" -> clause and if this particular string exists don't send the contents of the form. If eventually another form spammer gets through you look for another pattern only a spammer would use and insert it. That keeps my sites spam free for most of the year. For more detailed advice we would of course have to know what language you use. Very Happy

A quick hack in PHP would look something like this:

Code:

if ($ZIP=="Unknown") { $error .=" ZIP,";}
if ($place=="") { $error .=" place,";}
if (preg_match("/([\<])([^\>]{1,})*([\>])/i", $query)) { $error .=" query,";}

etc.

I know there's more sophisticated methods to be found using google but the above is what I usually do.

Hello I'm New here! Joined: 14 May 2007 Posts: 8

@Radden,

I have condidered that and personally it nearly always takes me a few goes to get it and so I don't think I can put my site visitors through that or lose them out of frustration.
I do have a simpler version on the page but that is no obstacle to these geezers.

Posted: Tue May 29, 2007 9:48 pm

I don't know how much this will help. But you can opt. to have your whois information listed as private so your contact information can't be sniffed out that easily. You may have to pay a few buck extra.

http://www.networksolutions.com/domain-name-registration/private.jsp

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

garydaw wrote:

it nearly always takes me a few goes to get it

Me too, but to my mind it doesn't have to be that obscure - How often do spammers have OCR? You should get 99% effectiveness by using clearly readable text.

Elite Baiter Joined: 02 Jul 2006 Posts: 1702

spam drives me nuts, especially on a forum.

.htaccess may be the better way to go its not all that complicated

first you need to get the ip of the computer visiting your website, then manually add that to the htaccess

order deny/allow

Also if you do get it wrong and block a genuine member - apologies lol and grovel lol too. It is a bit of extra work and a major headache but on registration with a blacklist etc it will make it less likely for spam to try to bother joining just to post a link. The idiots will still try to join but its harder as the mail emails i know of from my own site is *@mail##.com where the ## is generally a number (there are many more but for me its the ones at mail333.com that bug me Sad

** SUSPENDED ** Joined: 26 Mar 2005 Posts: 1267

"order deny/allow "

are you thinking about robots.txt? I've kept spam away without editing the .htaccess.

Hello I'm New here! Joined: 14 May 2007 Posts: 8

@digital-one,

This interests me.Upon going through my last 50 or so form spam emails I discover all but 4 are different.Does this indicate to you that they are able to endlessly create new IPs and so entirely outrun my eforts at banning them in the htaccess file?Or if I keep trying will I eventually find that there is a manageable number-say under 1000 that just repeat themselves?It would be great if these IPs were available for download somewhere (Spamcop? Mailwasher?)

** SUSPENDED ** Joined: 26 Mar 2005 Posts: 1267

they're either using localhost machines or zombie computers (computers overtaken by a trojan/etc).

IP bans on spammers are useless.

Hello I'm New here! Joined: 14 May 2007 Posts: 8

Full requote of previous post deleted. It's there ^^^^

If they are zombies is it possible to alert them?
By the way robots.txt has never worked for me.I think they are a voluntary code that doesn't apply to this crowd Sure you are not just lucky?

Elite Baiter Joined: 02 Jul 2006 Posts: 1702

umm radden i meant the other way round only allowed IP's can post lol so by default everyone he chooses to allow to join becomes a member and as long as he remembers each isp on broadband has around 10 ip's such as ranges then he should keep spammers away, because only allowed ip ranges can post but any ip can try to register Wink

then a bit of moderation to kill the suspect spammers accounts

nope i didnt mix up the robots and .htaccess lol, but mentioning robots if the search engine does not list his online form then spammers wont know it exists lol so perhaps...

@gary you wouldnt block ip's en masse you would ALLOW ips from members, you can then make a script - if the member can login and the ip is different it adds it to the database as an allowable addy, this means spammers simply cant post unless you turn them into members thus blocking spam from appearing. if used in addition to email and username banning etc you have an effective spam system. It does however rely on human verification - simply to avoid banning real people for joining.

Hello I'm New here! Joined: 14 May 2007 Posts: 8

Unnecessary full requote of previous post deleted. We can all see it up there ^^^^

Unfortunately mine is only a contact form so I can't make the visitors login.Does anyone know if the Spam progs like Mailwasher rely on IPs at all?

Suggestions for stopping form spam on websites?	View next topic View previous topic