1

I created a web contact from with the following restrictions:

  1. An IP can send only 1 query per 8 hours.
  2. A generic text based bootstrap captcha for the form (I know this can be replaced with reCaptcha)

Still, I am getting anonymous hits by some IPs, which are spamming my form. Thanks to the IP restriction I created, I am not getting much of them, but still getting spams.

I am searching for any solution, other than the one suggested by sampablokuper in this answer https://security.stackexchange.com/a/110074/106708, which says, I can send user a confirmation email for the submission of the enquiry. That is a feasible answer, but I am using GoDaddy SMTP Servers, which are delivering mails with a prominent delay.

Also, what would be the motive of the spammers, they are sending texts in languages which I could not understand, they put the phone or email, which is also fake. I cannot understand the motive of the spammer.

3

You will never prevent all spammers; not with a CAPTCHA or any technical means. Some spammers hire "smurfs", which are large numbers of people who each send one spam per web site, but each person spams hundreds of sites.

The motive of the spammers is likely to use your site to deliver their spam in your response emails.

If your response to the contact form is to repeat whatever the user typed, then the message your spammers enter into your contact for will reach their target audience. Your ordinary response email looks like this to you:

To: Sibidharan@example.com

Thank you for your inquiry.  You wrote:

"I have a problem ordering widgets, 
 can you fix my problem?"

We will process your question promptly.
Thank you,
Example.com staff

The spammers want to send their spam to a victim. They go to your Contact Us page, where they put in the victim's address as their address. In your "Please enter your message" field, they put in their spam message in the victim's language: "BUY OUR CHEAP DRUGS SEND EMAIL TO CHEAP AT DRUGS DOT COM". They then submit their comments. The victim will receive this email from you:

To: victim@contoso.com

Thank you for your inquiry.  You wrote: 

"BUY OUR CHEAP DRUGS SEND EMAIL 
 TO CHEAP AT DRUGS DOT COM"

We will process your question promptly.
Thank you,
Example.com staff

But the victim does not speak English. They will only see this:

To: victim@contoso.com

blah-blah-blah-in-English 

"BUY OUR CHEAP DRUGS SEND EMAIL 
 TO CHEAP AT DRUGS DOT COM"

blah-blah-blah-in-English

To fight this, have your emailed response be generic:

To: victim@contoso.com

Thank you for contacting Example.com.
Your email is important to us and will be processed within 48 hours.

Example.com staff

That way whatever the spammers type will never reach the email clients, hopefully taking away the motive for the spammers to use your service. Your real response, of course, could include the original question, but your service agents would not be responding to obvious spam.

  • 1
    i updated the answer to provide a more specific example. – John Deters Apr 6 '16 at 21:29
  • 1
    Now I got the point. My present implementation is like the former !!! I will change them. You saved my web. Thanks :) – Sibidharan Apr 6 '16 at 21:30
  • 1
    I'm very glad to have helped you! – John Deters Apr 7 '16 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.