Comment form spam

Suddenly getting a flood of it

[cmendla]

All of a sudden, I am getting a bunch of comment form spam. The site only gets about 100 page views a day but I do make some money from it.

Anyway, the spam is for the usual viagra, diet drugs etc.

I seriously doubt that it is a DOS attack, just a nuisance.

Common items-
- The first field is called name and usually has buy___
- Other fields are full of random letters
- Email is random letters at yahoo.uk address
- IP is from RIPE in the Netherlands
- The comments field has a bunch of links to mostly pharmaceutical sites.

Has anyone else seen a surge in commet form spam like this?

I'm probably going to
1. Block the ip range that I'm seeing the spam from
2. If that doesn't work, I'll try changing the name of the contact form.

thanks

cg

[treeline]

Using yahoo email addresses seems very common. I've noticed almost all the crap submissions I get use them. If you quietly block any comments using a yahoo email (without warning them) you might have some success.

[rocknbil]

cmendla - you've been found by one of the spam bots and it's not going to stop. The worst part of this is it's possible the script directly puts data into one of the mail headers. Basically this **can** mean that each mail you recieve, the injection can be creating it's own BCC mail header field and sending thousands of emails in your name. extended discussion here [webmasterworld.com].

Changing the script name lasts for about five minutes. Banning through .htaccess works, but it's a long and arduous maintenance task as you will see - once you plug one IP or entire range, another whole list of them will appear. Eventually you wind up banning IP's you don't really want to (i.e., many of these attacks come from compromised machines of ordinary users.)

One easy trick that will stop them is to create a hidden field in your form.
<input type="hidden" name="some-enticing-fieldname" value="">

If this field is populated, stop the script immediately. Only a bot will populate hidden fields in your forms.

For extended methods see the above link - most important of which is log ALL data input from your forms.