How do you prevent spamming through a form? - GoFuckYourself.com

StuartD · 07-09-2006, 06:19 AM

I built a simple guestbook script and recently it's been getting hit pretty hard by poker spammers with all kinds of various crap... over 200 submissions in 2 days.

The question is, what's a good way to prevent that without limiting genuine guestbook submissions?

And no, I don't want to go with image verification because it's just a guestbook for every day people. I don't want to make it a chore for them.

I checked the referrer and it is coming from my own site, so it's not an off the site submission. Someone must have built a spammer that submits the actual form on the page.. so I can't just check for the referrer

NdO · 07-09-2006, 06:29 AM

You could try to block them based on their ip's. Another option is a blacklist. (With urls / poker / pharmecy words etc.)

scottybuzz · 07-09-2006, 06:30 AM

yeh goodluck for you,

StuartD · 07-09-2006, 06:44 AM

Quote:

Originally Posted by NdO

You could try to block them based on their ip's. Another option is a blacklist. (With urls / poker / pharmecy words etc.)

different IP for each submission, I thought of that myself...

It's looking more and more like I'll have to go the "keyword" route, and try to keep on top of things that can't be submitted. That's going to suck though.

Especially since this seems to be affiliate type crap, which means getting some messed up urls such as online-poker-games . halpinos.com/ and internetpoker2.tblog . com/
(urls broken cause I don't want to send them any more traffic than they already get)

EdgeXXX · 07-09-2006, 06:47 AM

Tough to do without "making it a chore" for the legitimate people. What about screening for (filtering) certain keywords like poker, join, etc.?

MaddCaz · 07-09-2006, 06:50 AM

Quote:

Originally Posted by EdgeXXX

Tough to do without "making it a chore" for the legitimate people. What about screening for (filtering) certain keywords like poker, join, etc.?

Damian_Maxcash · 07-09-2006, 07:00 AM

Single letter verification would be ok on a small site...."Press '$randomletter' to post your comment" instead of a submit button for example.

Nobody is going to bother writing a script to post on a single small site - it would just go into the 'not worth it' file.

On a larger site where it would be worth the time and effort then I am out of ideas.

SMG · 07-09-2006, 07:08 AM

there are a few ways to do it from the ip things to other tricks that keep out most automated submissions ... if it's a php script, I can talk with you about hardening the script a bit to stop the spammers, just hit me up on icq 6354 0110

everestcash · 07-09-2006, 07:17 AM

got the same problem - with regbots on my dating forum & my blogs ((
on blogs i simply suspend posts with urls in them
on board i use visual code, email confirmation & ban spammers email periodicaly - but it doesn't help much ((

everestcash · 07-09-2006, 07:19 AM

Quote:

Originally Posted by damian2001

Single letter verification would be ok on a small site...."Press '$randomletter' to post your comment" instead of a submit button for example.

sounds interesting
will try it )
thanks

EdgeXXX · 07-09-2006, 07:25 AM

Quote:

Originally Posted by damian2001

Single letter verification would be ok on a small site...."Press '$randomletter' to post your comment" instead of a submit button for example.

Nobody is going to bother writing a script to post on a single small site - it would just go into the 'not worth it' file.

On a larger site where it would be worth the time and effort then I am out of ideas.

This is a good idea and I like it. The only problem is that everyone is assuming that these are automated spams, which they may be, but what if it is just someone that is manually pasting the spam? If this were the case, they would have no problem clicking buttons or even verifying images. But like I said, I love your idea as an added measure of security.

smutx · 07-09-2006, 07:35 AM

Quote:

Originally Posted by StuartD

I built a simple guestbook script and recently it's been getting hit pretty hard by poker spammers with all kinds of various crap... over 200 submissions in 2 days.

The question is, what's a good way to prevent that without limiting genuine guestbook submissions?

And no, I don't want to go with image verification because it's just a guestbook for every day people. I don't want to make it a chore for them.

I checked the referrer and it is coming from my own site, so it's not an off the site submission. Someone must have built a spammer that submits the actual form on the page.. so I can't just check for the referrer

try renaming the input feilds to something different.. like someone eles said no one really targets a site, its done on a mass level is it should do the trick

WiredGuy · 07-09-2006, 11:38 AM

Another idea involves making use of javascript. Basically, encode the html into a cryptic javascript such that bots can't parse the parameters out of the form. This does of course mean only javascript enabled users can use the form though.
WG

StuartD · 07-09-2006, 12:01 PM

Quote:

Originally Posted by WiredGuy

Another idea involves making use of javascript. Basically, encode the html into a cryptic javascript such that bots can't parse the parameters out of the form. This does of course mean only javascript enabled users can use the form though.
WG

Hmm... that's certainly a thought... that would be a good way to prevent spammers from mass submitting.

WiredGuy · 07-09-2006, 12:04 PM

Quote:

Originally Posted by StuartD

Hmm... that's certainly a thought... that would be a good way to prevent spammers from mass submitting.

Ideally the OCR will probably stop the most spam and should work for most users. Javascript encryption would mean a small percentage of users will be unable to use it but should stop spammers as well. To me, I'd prefer the OCR with a simple 2-3 character recognition, that should hopefully not inconvenience the surfers too much.
WG

CamsLord · 07-09-2006, 12:05 PM

yea ocr images will fix that

fris · 07-09-2006, 12:06 PM

i find image verify works best. anything without that on any kind of form is just silly.

WiredGuy · 07-09-2006, 12:06 PM

Another suggestion I also wanted to make was based on a simple question any human can answer, thereby making a simple password verification type deal. For example, instead of asking for an OCR just ask a simple question like what color is the sky? Bots will have no idea and leave this query blank, humans will just enter blue and get right through.
WG

line · 07-09-2006, 12:15 PM

Wow, after seeing these suggestions I can see why spam is so pervasive.

SmokeyTheBear · 07-09-2006, 01:36 PM

add this to your form <input type=hidden name=botcheck value=nobot>

then in the php script put this as your first line

if ($botcheck == "nobot") { } else {

$url = "SPAM"

}

where $url would be one of the items in your form like an url that will then get turned blank if the hidden input isn't present.

This isnt a great solution , but this will prevent most box-automated type submissions.

Just change the "botcheck" to something different every so often ( on both the form and the script )

StuartD · 07-10-2006, 06:24 AM

Some great suggestions. Thanks everyone

Why · 07-10-2006, 07:48 AM

turing image.

07-09-2006, 06:19 AM	#1
StuartD Sofa King Band Join Date: Jul 2002 Location: Outside the box Posts: 29,903	How do you prevent spamming through a form? I built a simple guestbook script and recently it's been getting hit pretty hard by poker spammers with all kinds of various crap... over 200 submissions in 2 days. The question is, what's a good way to prevent that without limiting genuine guestbook submissions? And no, I don't want to go with image verification because it's just a guestbook for every day people. I don't want to make it a chore for them. I checked the referrer and it is coming from my own site, so it's not an off the site submission. Someone must have built a spammer that submits the actual form on the page.. so I can't just check for the referrer

07-09-2006, 06:30 AM	#3
scottybuzz Too lazy to set a custom title Industry Role: Join Date: May 2006 Location: NY Posts: 14,799	yeh goodluck for you, __________________ $$$$$ MAKE HUGE MONEY IN CAMS - CLICK HERE $$$$$

07-09-2006, 06:47 AM	#5
EdgeXXX Confirmed User Join Date: Nov 2005 Location: Secretely plotting a hostile takeover Posts: 5,816	Tough to do without "making it a chore" for the legitimate people. What about screening for (filtering) certain keywords like poker, join, etc.? __________________ . . . . I have a sig

07-09-2006, 07:08 AM	#8
SMG Confirmed User Join Date: Aug 2003 Posts: 1,798	there are a few ways to do it from the ip things to other tricks that keep out most automated submissions ... if it's a php script, I can talk with you about hardening the script a bit to stop the spammers, just hit me up on icq 6354 0110 __________________ TGP Webmasters: sign up for the top 100 tgp list! Submit galleries If you add me to icq (title) make sure to mention GFY or I'll think you're a bot and deny you.

07-09-2006, 07:17 AM	#9
everestcash Confirmed User Join Date: Apr 2002 Posts: 2,194	got the same problem - with regbots on my dating forum & my blogs (( on blogs i simply suspend posts with urls in them on board i use visual code, email confirmation & ban spammers email periodicaly - but it doesn't help much (( __________________ Got solo girls/teen traffic? Promote our exclusive solo girl sites and boost your income!

07-09-2006, 06:29 AM	#2
NdO Confirmed User Join Date: Jun 2006 Location: NL Posts: 336	You could try to block them based on their ip's. Another option is a blacklist. (With urls / poker / pharmecy words etc.)

07-09-2006, 07:00 AM	#7
Damian_Maxcash So Fucking Banned Join Date: Oct 2002 Location: MaxCash.com Posts: 12,745	Single letter verification would be ok on a small site...."Press '$randomletter' to post your comment" instead of a submit button for example. Nobody is going to bother writing a script to post on a single small site - it would just go into the 'not worth it' file. On a larger site where it would be worth the time and effort then I am out of ideas.

07-09-2006, 11:38 AM	#13
WiredGuy Pounding Googlebot Industry Role: Join Date: Aug 2002 Location: Canada Posts: 34,504	Another idea involves making use of javascript. Basically, encode the html into a cryptic javascript such that bots can't parse the parameters out of the form. This does of course mean only javascript enabled users can use the form though. WG __________________ I play with Google.

07-09-2006, 12:05 PM	#16
CamsLord Confirmed User Join Date: Jun 2006 Posts: 3,663	yea ocr images will fix that __________________ sig for sale - pornpicz(at)gmail.com

07-09-2006, 12:06 PM	#17
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,481	i find image verify works best. anything without that on any kind of form is just silly. __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. My Cam Feeds Script

07-09-2006, 12:15 PM	#19
line Registered User Join Date: Jul 2002 Posts: 63	Wow, after seeing these suggestions I can see why spam is so pervasive. __________________ [whore yourself here]

07-09-2006, 01:36 PM	#20
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	add this to your form <input type=hidden name=botcheck value=nobot> then in the php script put this as your first line if ($botcheck == "nobot") { } else { $url = "SPAM" } where $url would be one of the items in your form like an url that will then get turned blank if the hidden input isn't present. This isnt a great solution , but this will prevent most box-automated type submissions. Just change the "botcheck" to something different every so often ( on both the form and the script ) __________________ hatisblack at yahoo.com

07-10-2006, 06:24 AM	#21
StuartD Sofa King Band Join Date: Jul 2002 Location: Outside the box Posts: 29,903	Some great suggestions. Thanks everyone

07-10-2006, 07:48 AM	#22
Why MFBA Industry Role: Join Date: Mar 2003 Location: PNW Posts: 7,230	turing image.