2

I operate a simple lead-generation website for a friend, consisting of a single page with an HTML form with just one field: email address.

We are getting an unexpected number of POSTs to the form's action URL.

Each one has a different, and apparently genuine, email address, but we are getting way more than we would expect for our little website.

What possible malicious purpose could these POSTs have? We have never sent email to any of the addresses submitted, yet the POSTs continue.

There is nothing else in the POST request. Nothing else in the body, nothing added to the URL, no query parameters, nothing that looks like SQL injection attempts, no unique IDs to identify the request, no garbage, nothing.

The rate is less than a hundred a day. Nothing that could suggest a DOS attempt.

The source IPs are different, but the User Agent strings are always the same, which suggests the requests are coming from a bot or a script.

It all seems pretty harmless, but I'm curious what the purpose could be in abusing our form like this?

  • How may requests would be "normal"? Has your site been featured or made public somewhere? – Tom K. Jul 28 '17 at 10:37
  • "normal" would be 1 or 2 requests per week. The site is not easily found on google. I wouldn't expect many people to know about it as we haven't told anyone yet. A few friends have tried the site, but that's it. – Alex Jul 28 '17 at 11:23
  • Does the site allow (by design or fault) an unauthenticated user to view the email addresses added to your list? You could consider adding a captcha to the submission form if you think this is a bot. – iainpb Jul 28 '17 at 13:39
  • Try tell the browser to turn off autocomplete and observe stackoverflow.com/questions/14725332/… – mootmoot Jul 28 '17 at 14:16
1

The attacker may not know that the form doesn't do anything. In particular, they may assume that it sends an email to the submitted address (which is a fairly common pattern, used for sign ups). In that case, they could either be trying to annoy people, by having lots of junk sent to them, or to increase the noise level for the email addresses spam filter - if it accepts your emails, even though the user hasn't actually submitted their address, the user may start flagging extra things as spam (resulting in them missing something important, like a password reset email), or the spam filter may start considering more things as "useful", and hence be more likely to allow actual spam through.

I'm dubious that it's a particularly effective approach, given modern spam filters, but it would be low effort.

Another possibility is that they're trying to get your system into spam filter lists. This obviously wouldn't work if you aren't actually sending anything, but it doesn't take a lot of messages to be marked as spam before sites like Gmail start filtering or flagging messages as potential spam.

  • Some good points, thanks. I thought they would probably have tried an address that they own, to test whether the email gets sent, before deciding whether to (ab)use the site. – Alex Jul 28 '17 at 11:19
  • That would require more effort - it's easy enough to script a bot which looks for fields named "email" or similar then fills them in. Could even just leave it on someone else's server without their knowledge. If you check, though, you've linked it to you in some way. – Matthew Jul 28 '17 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.