Re: [WSG] More on spam traps
Mike Kear > I think its important to give the spammer no indication that you are onto > them. If you give them any kind of feedback, they can use that to work a > way through your maze.The filters i use (which are similar to yours on > the client side, but I also use some tests on the server side, but the > submitter sees the same result either way. Even if the submission is just > discarded to the bitbucket in the sky. They have no way to know their > submission has been discarded. That's awfully public-spirited of you, as it makes the spammer slower to move on to attacking another website, but it can get expensive. If some spammers think they are being successful, they will absolutely hammer your server and that could burn your data transfer allowance, or even overload your server if the tests aren't written carefully. Let them submit a few forms and then 302 redirect them to something like http://spam-ip.com/honeypot.php perhaps. Thanks, -- MJ Ray (slef), member of www.software.coop, a for-more-than-profit co-op. http://koha-community.org supporter, web and library systems developer. In My Opinion Only: see http://mjr.towers.org.uk/email.html Available for hire (including development) at http://www.software.coop/ *** List Guidelines: http://webstandardsgroup.org/mail/guidelines.cfm Unsubscribe: http://webstandardsgroup.org/join/unsubscribe.cfm Help: memberh...@webstandardsgroup.org ***
RE: [WSG] More on spam traps
I think its important to give the spammer no indication that you are onto
them. If you give them any kind of feedback, they can use that to work a
way through your maze.The filters i use (which are similar to yours on
the client side, but I also use some tests on the server side, but the
submitter sees the same result either way. Even if the submission is just
discarded to the bitbucket in the sky. They have no way to know their
submission has been discarded.
Cheers
Mike Kear
AFP Webworks
Windsor, NSW, Australia
http://afpwebworks.com
From: li...@webstandardsgroup.org [mailto:li...@webstandardsgroup.org] On
Behalf Of coder
Sent: Wednesday, 22 August 2012 9:38 PM
To: wsg@webstandardsgroup.org
Subject: [WSG] More on spam traps
Hi All,
I have recently attempted to 'trap' spammers who use autofilling tactics on
the site at www.gwelanmor-internet.co.uk. This is written in html5 and uses
a mixture of simple tests to validate the form. However, yesterday I recvd
a mail thus:
_
. name
* igmgrtasel
. email
*
. hidden
* -9
. comments
* CaWePF http://ipdszgwutyvp.com/";>ipdszgwutyvp,
[url=http://fkpbtvpaxitv.com/]fkpbtvpaxitv[/url],
[link=http://rtcdalwdjrkb.com/]rtcdalwdjrkb[/link], http://xsejahukjzdr.com/
. send
* send message .
_
The script I used to validate the form is this:
function validateForm()
{
var x=document.forms["contact"]["email"].value;
var atpos=x.indexOf("@");
var dotpos=x.lastIndexOf(".");
if (atpos<1 || dotpos=x.length)
{
alert("This is Not a valid e-mail address");
return false;
}
//
var y=document.forms["contact"]["hidden"].value;
if (y==null || y=="")
{
return true;}
else
{
alert("I think you are a machine")
return false;
}
}
function check(node)
{
var re = new RegExp('[<>\[\\]]', 'g');
document.getElementById('send').disabled = re.test(node.value);
}
and it works locally and online. However the mail I quote from above is
completely unaffected. Does this mean I give up trying, or what?
Any thing?
Thanks,
Bob
No virus found in this message.
Checked by AVG - www.avg.com
Version: 2012.0.2197 / Virus Database: 2437/5212 - Release Date: 08/20/12
***
List Guidelines: http://webstandardsgroup.org/mail/guidelines.cfm
Unsubscribe: http://webstandardsgroup.org/join/unsubscribe.cfm
Help: memberh...@webstandardsgroup.org
***
***
List Guidelines: http://webstandardsgroup.org/mail/guidelines.cfm
Unsubscribe: http://webstandardsgroup.org/join/unsubscribe.cfm
Help: memberh...@webstandardsgroup.org
***
Re: [WSG] More on spam traps
Hi Bob,
A few points:
- The form submission was likely posted without JavaScript
- There is no point confronting a robot with the reality of it’s existence
Look into writing a filter on your email inbox or server that can
eliminate such messages without your intervention.
Don’t give up :)
Ollie
--
@ollicle
On 22 August 2012 21:07, coder wrote:
> I have recently attempted to 'trap' spammers who use autofilling tactics on
> the site at www.gwelanmor-internet.co.uk. This is written in html5 and uses
> a mixture of simple tests to validate the form. However, yesterday I recvd
> a mail thus:
>
>
>
> name
>
> igmgrtasel
>
> email
>
> hidden
>
> -9
>
> comments
>
> CaWePF http://ipdszgwutyvp.com/";>ipdszgwutyvp,
> [url=http://fkpbtvpaxitv.com/]fkpbtvpaxitv[/url],
> [link=http://rtcdalwdjrkb.com/]rtcdalwdjrkb[/link], http://xsejahukjzdr.com/
>
> send
>
> send message .
>
>
>
> The script I used to validate the form is this:
>
>
>
> function validateForm()
> {
> var x=document.forms["contact"]["email"].value;
> var atpos=x.indexOf("@");
> var dotpos=x.lastIndexOf(".");
> if (atpos<1 || dotpos=x.length)
> {
> alert("This is Not a valid e-mail address");
> return false;
> }
> //
> var y=document.forms["contact"]["hidden"].value;
>if (y==null || y=="")
>{
>return true;}
> else
>{
> alert("I think you are a machine")
> return false;
>}
>
> }
>
> function check(node)
>{
> var re = new RegExp('[<>\[\\]]', 'g');
> document.getElementById('send').disabled = re.test(node.value);
>}
>
>
> and it works locally and online. However the mail I quote from above is
> completely unaffected. Does this mean I give up trying, or what?
***
List Guidelines: http://webstandardsgroup.org/mail/guidelines.cfm
Unsubscribe: http://webstandardsgroup.org/join/unsubscribe.cfm
Help: memberh...@webstandardsgroup.org
***
Re: [WSG] More on spam traps
Client side validation fails when scammers screen scrape your site and then
directly send to your receiving script. You really need to consider using a
server side validation.
Ken
Sent from my Verizon Wireless BlackBerry
-Original Message-
From: "coder"
Sender: li...@webstandardsgroup.org
Date: Wed, 22 Aug 2012 12:37:51
To:
Reply-to: wsg@webstandardsgroup.org
Subject: [WSG] More on spam traps
Hi All,
I have recently attempted to 'trap' spammers who use autofilling tactics on the
site at www.gwelanmor-internet.co.uk. This is written in html5 and uses a
mixture of simple tests to validate the form. However, yesterday I recvd a
mail thus:
a.. name
a.. igmgrtasel
a.. email
a..
a.. hidden
a.. -9
a.. comments
a.. CaWePF http://ipdszgwutyvp.com/";>ipdszgwutyvp,
[url=http://fkpbtvpaxitv.com/]fkpbtvpaxitv[/url],
[link=http://rtcdalwdjrkb.com/]rtcdalwdjrkb[/link], http://xsejahukjzdr.com/
a.. send
a.. send message .
The script I used to validate the form is this:
function validateForm()
{
var x=document.forms["contact"]["email"].value;
var atpos=x.indexOf("@");
var dotpos=x.lastIndexOf(".");
if (atpos<1 || dotpos=x.length)
{
alert("This is Not a valid e-mail address");
return false;
}
//
var y=document.forms["contact"]["hidden"].value;
if (y==null || y=="")
{
return true;}
else
{
alert("I think you are a machine")
return false;
}
}
function check(node)
{
var re = new RegExp('[<>\[\\]]', 'g');
document.getElementById('send').disabled = re.test(node.value);
}
and it works locally and online. However the mail I quote from above is
completely unaffected. Does this mean I give up trying, or what?
Any thing?
Thanks,
Bob
***
List Guidelines: http://webstandardsgroup.org/mail/guidelines.cfm
Unsubscribe: http://webstandardsgroup.org/join/unsubscribe.cfm
Help: memberh...@webstandardsgroup.org
***
***
List Guidelines: http://webstandardsgroup.org/mail/guidelines.cfm
Unsubscribe: http://webstandardsgroup.org/join/unsubscribe.cfm
Help: memberh...@webstandardsgroup.org
***
[WSG] More on spam traps
Hi All,
I have recently attempted to 'trap' spammers who use autofilling tactics on the
site at www.gwelanmor-internet.co.uk. This is written in html5 and uses a
mixture of simple tests to validate the form. However, yesterday I recvd a
mail thus:
a.. name
a.. igmgrtasel
a.. email
a..
a.. hidden
a.. -9
a.. comments
a.. CaWePF http://ipdszgwutyvp.com/";>ipdszgwutyvp,
[url=http://fkpbtvpaxitv.com/]fkpbtvpaxitv[/url],
[link=http://rtcdalwdjrkb.com/]rtcdalwdjrkb[/link], http://xsejahukjzdr.com/
a.. send
a.. send message .
The script I used to validate the form is this:
function validateForm()
{
var x=document.forms["contact"]["email"].value;
var atpos=x.indexOf("@");
var dotpos=x.lastIndexOf(".");
if (atpos<1 || dotpos=x.length)
{
alert("This is Not a valid e-mail address");
return false;
}
//
var y=document.forms["contact"]["hidden"].value;
if (y==null || y=="")
{
return true;}
else
{
alert("I think you are a machine")
return false;
}
}
function check(node)
{
var re = new RegExp('[<>\[\\]]', 'g');
document.getElementById('send').disabled = re.test(node.value);
}
and it works locally and online. However the mail I quote from above is
completely unaffected. Does this mean I give up trying, or what?
Any thing?
Thanks,
Bob
***
List Guidelines: http://webstandardsgroup.org/mail/guidelines.cfm
Unsubscribe: http://webstandardsgroup.org/join/unsubscribe.cfm
Help: memberh...@webstandardsgroup.org
***
