For the last two weeks we have been receiving a form of spam through our website contact form that I haven't seen before.
It looks like this:
Name: iYvNgmpTLwxqaCj
Company: lqidQuVNMhIJsz
E-Mail: [email protected]
Country: Please select...
Phone: 5217200934
Address: OsHSnquoU
Privacy Policy accepted: iaccept
Message:
MCGELokRdhvTQYK
The spammer's inputs to form fields are the parts after the colons.
Note: I have changed the mail address. It looked like a legitimate mail address of a larger company, e.g. [email protected]. That is always the case.
Every other field contains random strings of ASCII characters. The phone number seems to be a random number. The privacy field is populated from a checkbox.
Another fact is: We always receive exactly two of these messages at the same time. Not more, not less. The frequency is on average 1-2 attempts per day.
Does anyone have any idea what the purpose of such a spam message is?
Previous similar questions:
- Spam with random strings: Very similar style, but the key difference is that our spam does not contain any html of bbcode tags. So the answer doesn't fit.
- What is the point of gibberish spam: While the term gibberish certainly applies, our spam does not contain any words.
My ideas:
The thing I could think of is password bruteforcing, in that the bot doesn't notice that it is on a contact form and instead just tries to log in with a mail address and random password. However, the chances of this working are astronomically low, given the general odds and the low number of attempts (two).
Further information
After a while of dealing with the spam, here are some additional pieces of information:
- While I initially reported 2 spam messages per try, in fact the bot tried 62 times. Most were blocked from sending because a "privacy policy accept" box wasn't ticked. This indicates, that:
- It was indeed a bot, because the website front also prevents sending the form without the box ticked (client-side).
- Check- and radioboxes are probably randomly selected
- If the privacy box was NOT ticked, the form also contained no other content (fields empty).
- Per 62-tries attempt, the same IP was used. In later attempts a different IP was used.
- As Seb_Schulz suggested, I ran the mail addresses through HaveIBeenPwned, but most of them didn't turn up. So maybe it's from a new leak. However, it might be that the addresses are not valid. While the domains all exist, I mostly couldn't find the particular person associated (e.g. if domain is a university with public list of people).
Prevention
Since we didn't want to implement Recaptcha as our site is otherwise Google-free, we tried two mitigations of simple captchas.
We put in a question, e.g. "Select picture of the famous person xy", with two radiobuttons with pictures next to it. The user had to select the correct image. The correct one was the second radiobutton. This did not work, presumably because the boxes were randomly selected by the bot.
We replaced the question with a simple math question, e.g. "Please solve 4 + 2 = ", with a simple text input field. The question even always uses the same numbers. This works for now. I suspect, the bot would fill in its random characters into the box, which is obviously not the correct number.
I hope this helps someone.
example.comorexample.org. they are the official example emails. Using random domains is dangerous. Someone might register them and now your content might redirect users to a dangerous site, or a legitimate website could receive unwanted attention due to bad actors that find it through your content.