Forum Moderators: mack
Your developer will find a lot of discussion online about how captchas can be bypassed, then he can write code to prevent some of it. Even Gmail's captcha has been bypassed, so don't expect a foolproof method.
Use JavaScript execution to add some unique value to form that your script will check - most of bots can't handle those. If it human with disabled JavaScript then you can show polite message to enable it for the purpose of submitting this form.
It's not just manual entry. I have experienced robots breeze right past them on one VBulletin install.
Some of these "front end" approaches - the hidden blank field, BBW's "trivia question" approach, and anything that affects the front end form - will slow down and sometimes even stop the attacks, giving you the impression that the problem is solved.
I assure you, it's not. If they are determined, they will get around all those, or even resort to manual entry just to annoy you. The fix for this is to attack the root of the problem. Fix the script that is processing your form. Cleanse the data, and apply filtering if required. If you don't know how, contract someone to do it (and make them prove they can do it by supplying data to the revised form from spam you've received.) Don't make it your visitor's problem by asking them to fill out a captcha or other extra step they they may not understand.
In very extreme cases - and almost always this is limited to extreme cases - you can begin banning IP classes via the script or at the server level. The reasoning is if they are attacking your form, you don't want them poking around any of your site, period.
There are a variety of "duct tape" approaches and some of them will work for you, but may come back to haunt you after you think it was fixed. Fix the processor and be done with it.
This is discussed in deep detail in this thread [webmasterworld.com].
If link doesn't work, try this one [webmasterworld.com]
Personally I can live with it since I have my spam filter (Spambayes) trained to send these submissions straight into my spam folder.
I have someone who spams one of my forms about once or twice a day and each time one arrives it is stamped with a different IP address. Do you know of any way to filter this out?
The trivia question on your site appears to work for you, so if it works, roll with it. My comments are for general usage, and a precursory warning that front-end approaches alone won't solve everything.
To directly answer the question, without seeing what your processor is doing or the nature of what they are spamming you with, NO. Given a review of the actual script processing your form and a log of this spammer's input, I would say, 95% probability, yes.
However, if they are hitting you every day, you should be able to determine one of two things: either it's an automated 'bot, in which case you should be able to determine a pattern and plug it, or it's someone with a grudge and they are manually annoying you, in which case your method is probably the only thing that will thwart them. The latter is really an extreme case, which is why I say, if your processor is "fixed," it will stop most of these guys/gals/subhumans. :-)
There are actually some common factors in these submissions and anyone good at scripting could no doubt filter them out but I am afraid that I don't do this type of scripting.
We are a small manufacturer with an online store.
We have a simple Captcha on our contact us and order forms.
(I hate the Captchas that you have to try about 3 times because they are so hard to read)
Yet about once or twice a week some clown breaks into our form and spams us with a message taking them to a website which tries to sell diet pills.
Do they really believe that I would go to their web site to buy some diet pills when they have spammed me ?
But to me it is a real PITA as we do not get many sales so when we see Form2Mail in our email we get all excited !
Why do they bother ?
They must have to crack thousands of captchas to get one visit or sale !
Why do they bother spamming my web form ?
Because they can.
Yet about once or twice a week some clown breaks into our form and spams us with a message taking them to a website which tries to sell diet pills.
These are all automated, and most of them have 6 or 8 easily identifiable patterns. Remove the capchka, filter the data on input, and if it's found, immediately exit with a "no email was sent" response. Many say this is unworthy; just proceed as if the email was sent. But the problem with this is they think it worked so they, and more, will keep trying. The above approach has proven (in my experience) that after a time, they give up. Take away the candy and the malcontents will stop trying to steal it. :-)
However, I can offer no help in getting a stock script to do this for you, it will require some custom programming.
Do they really believe that I would go to their web site to buy some diet pills when they have spammed me ?
There's only one reason spam continues: it works. So if not you, someone else.
They must have to crack thousands of captchas to get one visit or sale !
Try millions . . . this is the whole deal, it's a game of numbers. P****ing off 2000 users is worth it if you get one sale, this is their philosophy. Generally they only have to find one "brand" of captcha, crack it, then seek out any sites that use that "brand." It's the same thing with forum or shopping cart vulnerabilities.
