Hello,

 

i have a problem with the php contact forms on one of my clients website. the forms get spammed with random characters. a typical content would look like this:

 

phone: vAdozQmqaAzRBKIWvov

 

fax: dzmXwdJOxYLWK

 

E-Mail: wzqter@ocqzac.com

 

Message: ahbmt3 <a href="http://upwrnzbwwgeb.com/">upwrnzbwwgeb</a>, hszemhuheder, [link=http://exjkoisxvkrh.com/]exjkoisxvkrh[/link], http://cvllnrthvmyj.com/

 

What i don't get is what the spammers are trying to do here. What is the use of filling contact forms with random content? All the links are randomized as well and do not lead to infected websites or anything like that.

Edited December 27, 201015 yr by renebrungs

They are seeing if the script is compromised so that they can use it as a relay

As above they are simply checking for holes within your script, a simple and hassle free way to stop a large majority of this is simply add an additional field to your form , name it something like email, username or password and hide the element with CSS.

 

Thus users won't see the field, bots will, thus any non NULL input is a bot

Edited December 27, 201015 yr by CSN-UK

as CSN-UK said, make a form field that has lots of juice that a bot would love. I find they love the email one. Here is what i use:

 

<li class="" style="display:none;visibility:hidden;">
			<label for="email">
				Ignore this text box. It is used to detect spammers.
				If you enter anything into this text box, your message
				will not be sent.
			</label>
			<input type="text" name="email" size="1" value="" id="email"/>
	</li>

 

Then in your php if it is filled in, then you know it is a spammer.

 

I also use this:

 

if (preg_match( "/bcc:|cc:|multipart|\[url|Content-Type:/i", implode($_POST))) {
    $spam=true;
}

 

Im not a php expert, buit I found it on a anti-spam blog and after using this, I didn't get one spam email again. So something must be working there.