I am the webmaster for my girlfriend's page where she advertises her services as an online tutor. The webpage has a simple PHP post form, using which the visitors can leave their e-mail addresses to be contacted about possible lessons. Once an e-mail address is received, it is validated and then e-mailed to me. Usually there's a message once every 3-4 days.

Since yesterday I have received about 50 e-mail messages with different e-mail addresses, about once every half hour or so. I checked the IP addresses of the senders, and they are from proxy servers all over the world, so I can't just filter them out based on IP. The e-mail addresses themselves are linked to spammers (according to Google). I am assuming it is a bot and not a real person typing these e-mail addresses into the form.

Can anyone suggest how I could stop this deluge of spam? I guess I could try to figure out how to use a captcha, but, before I do it, maybe there is an easier way? Also, could anyone perhaps explain their motivation? How could they possibly expect to benefit from this?

Thank you.

  • 1
    motivation of spammers is volume, volume, volume. the more they send, the more likely a single message may get through and give them yet one more "real" place to send advertisements. its the "shotgun" concept...not every message has to hit a mark. but the more they send, the greater the odds something gets through, somewhere. that being said, they might not be actively targeting you/your girlfriend. they probably have a spider or ran an advanced search engine query, found your site had an unprotected email input, and added it to the list of "places to spam". automation is great... =P – 0xSheepdog Apr 10 '17 at 22:05
  • 5
    Use something like Google RECaptcha google.com/recaptcha/intro – multithr3at3d Apr 10 '17 at 23:14

You need to use an automated system to defend the form entry.

Currently, something like RECaptcha, also mentioned by @korockinout13 (+1) is probably the most common solution to do this.

You might also want to leverage something like Fail2Ban to block repeat offenders.

For certain businesses, larger scale whitelisting/blacklisting of IP's may be useful. For example, if you notice that the IP addresses causing harm are always from Tor relay IP address ranges blocking these might be helpful for you but do take into account privacy reasons that a legitimate user may want to connect to you via tor. If this is unlikely to ever happen then blocking these IP's may in some cases be helpful. Similarly, if you don't ever do business with some other country but 99% of the form attacks come from IP addresses in that country you might consider blocking that countries IP addresses for a while but do not do this blindly because some of your customers do travel and other countries may have valid business for you or legitimate reasons to visit your site.

Some website frameworks, like Django, have additional add-on anti-automation defences and honeypots that may also help.

Finally, it is wise to use more than one of these solutions as there are already tools like Bishop Fox's Anti-Anti-Automation Framework which can help attackers and penetration testers get around some of these systems. Ultimately, your goal is just to make it more expensive and time-consuming for attackers to the point they stop impacting your forms.

In any case, you want an automated solution that doesn't create a lot of work for you.


Action number one: change the name of the entry field on the form, and more particularly on the receiving system (whatever software actually sends the emails). 99% of the time, the spam-bot doesn't actually use your page, it just notes the parameter needed to make your script work, so if you change that, it will break their bot, though only temporarily.

Action Two: Research what is the most appropriate spam-reduction system for your specific needs - there are too many options/variable for anyone to make a recommendation here.

  • 1
    This solution does not help in any sustainable or permanent way. It would lead to a constant whack-a-mole game versus the spammer and you even acknowledge it. The correct answer to this problem was posted by Trey Blalock already 2 years ago. – SeeYouInDisneyland Mar 25 at 11:03
  • @SeeYouInDisneyland I stand by my answer - as a first-aid / initial-response to stop the deluge. – Mike Brockington Mar 25 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.