Getting back at spammers trying to hijack my FormMail

Make a bogus FormMail script to eat their spam?

[MichaelBluejay]

I'm tired of all the spammers looking for FormMail.pl on my servers, so I'm trying to think of how I can get back at them. The only think I can think of is to take a FormMail.pl script and disable the mail-sending part of it, so that it doesn't actually do anything. Then spammers would be wasting their time feeding a bunch of data to my script and their spam doesn't get sent out, though the spammer wouldn't know that. I wouldn't just be thwarting the spammer, I'd be saving ISP's and users from having to deal with the spam. I could be a folk hero! Or something.

I did think of redirecting all the spam right back to the sender, but that wouldn't work because they usually don't use valid From: addresses -- and worse, they steal somebody else's From: address. Plus, it wouldn't trick the spammer into thinking they sent their spam successfully.

Anyway, I'm not really versed in this sort of thing so there might be something I'm not seeing, or there might be an even better way to get back at FormMail.pl hijackers that I'm not seeing -- which is why I'm posting, to see what the experts have to say.

[jim_w]

I don't have FormMail.pl any where on my server, so when they try to find it, and all variations there of, I redirect them to the FBI so it looks like they are trying to hijack the FBI computers. I haven't had any problems with anyone even trying for about a year now. Of course you could also use the ISP they are coming in on.

[jamesa]

Heh, I did that once. Found a guy spamming one of my formmail scripts, so I modified it - looked normal, but I disabled the sendmail code and instead just logged all the activity. He went on for 2 months before he got wise. :)

[grandpa]

It's easy enough to ban them on the first attempt, if you have access to your htaccess file.

Redirect all requests for FormMail to a Trap.pl script, which adds their URL to a banned environment in your htacccess.

I found the script for Trap.pl here [webmasterworld.com] at WW.

[volatilegx]

A great trap would be to write a script that does a whois lookup for their IP address and finds the abuse@ address for it. Every email they try to send through your formmail.pl script could be sent insead to the abuse@ address along with a note inserted which reports the offending IP address, the fact that the formmail.pl script was hijacked, and the time and date :)

[MichaelBluejay]

I would love an auto-abuse-sending script. Until someone comes up with one, though, banning them from my site isn't good enough... I want revenge! I'd much rather waste their time making them think they're sending out spam when they're really not.