Somebody spamming our website's enquiry forms?

[McGraw]

On our work recruitment website there are two enquiry forms. One is for clients looking for staff and the other is for candidates looking for work.

Recently, the e-mail adress that picks up these enquiries is getting bombarded with pointless e-mails. They are just a random series of letters in front of our domain name. This then appears on every line of the enquiry form.

We are getting lots of e-mails like this and it's quite annoying.

The IP address shows up with every e-mail and it's the same every time.

When you insert the IP into a browser, it comes up with a Lotus Domino development page.

Any clues?

Thanks a lot.

[v0id]

set your catch-all email address to :blackhole:

We get these as well, quite a few recently - I just ban the ip from accessing the server.

[punky]

If you don't have server access, then one thing you can do is alter your mailing script to ignore requests from that address. Are you using PHP to mail the form to you? if you are, then you could do something like this:

PHP Code:


if ($_SERVER['remote_addr'] == 'ip.add.here')
{

//echo message about using being banned

}

else
{

//usual mailer script goes here.

} 


Not sure about CGI ones, as I don't use Perl.

HTH.

[Angua]

Or you could put in one of those script checkers that only humans can read to verify it's a person

[Richard M]

Originally Posted by punky

If you don't have server access, then one thing you can do is alter your mailing script to ignore requests from that address. Are you using PHP to mail the form to you? if you are, then you could do something like this:

PHP Code:


if ($_SERVER['remote_addr'] == 'ip.add.here')
{

//echo message about using being banned

}

else
{

//usual mailer script goes here.

} 


Not sure about CGI ones, as I don't use Perl.

HTH.

You'd need to use about 4 different variables to stop it because proxies use two just by themselves.
Also depends on HTTP version.

[Bifta]

Originally Posted by McGraw

On our work recruitment website there are two enquiry forms. One is for clients looking for staff and the other is for candidates looking for work.

Recently, the e-mail adress that picks up these enquiries is getting bombarded with pointless e-mails. They are just a random series of letters in front of our domain name. This then appears on every line of the enquiry form.

We are getting lots of e-mails like this and it's quite annoying.

The IP address shows up with every e-mail and it's the same every time.

When you insert the IP into a browser, it comes up with a Lotus Domino development page.

Any clues?

Thanks a lot.

Same thing is happening to us, it's someone basically checking for a PHP vulnerability in your forms, however, it happens with formmail too which is Perl not PHP, one of the CC email addresses should be an AOL account, do a search on that account on Google and it'll show you loads of stuff on it.

[McGraw]

Cheers for the help. Have passed the info on.

[Matth]

A plain "mailto" form, or something more advanced?

It may compromise compatibility, but you could take away the form submit button, and submit the form by a javascript function from a link or button.

Also, use some javascript validation, so that if an email address is required, the field must contain @

Might be someone trying to find vulnerable form mailers, as some can be coerced into sending to other addresses, but you'd expect to see the probable target email address.

If you use mailing lists, maybe they need washing - I've "graffiti'd" webpage forms of companies that I believed spammed me, and consider it an entirely justified response.