Possible Duplicate:
What kind of spam is this?

I'm running a web site with a forum where one small part is open for posting from unregistered users. The site uses captcha, but still some spam posts get through every day. Here is the thing. All of the messages follow the same pattern, but all also come from different IP's. That makes me thing this is some sort of automated scripted "attack" from a botnet of some sorts.

The strange thing is that all the messages start with six random characters and contains a couple of links. The words have no meaning and the domains in the links does not even exist.

Why would anyone use time and resources spreading these things? Below you can see two of these messages:

A5Zfs6 exrzvrbspntz, [url=http://nktqoqllnuab.com/]nktqoqllnuab[/url], [link=http://wtrenldadvsy.com/]wtrenldadvsy[/link], [http://rnlrqfgdvdot.com/]

O2oLpL nqeffxhryfdk, [url=http://jutyurbpfxow.com/]jutyurbpfxow[/url], [link=http://jpcdtmdalpow.com/]jpcdtmdalpow[/link], [http://qopqwqxwjdjx.com/]

Since all the messages come from different IP's I can't see blocking those will help much. For now I'm considering just dropping all messages following this pattern since it's quite easy to match with a regexp.

Have anyone else seen these kinds of messages or know the point of posting them?


It's probably a test for a real attack, proof of concept for an attackers new system, or a demonstration of an attack for potential buyers maybe? I would tend to think this was not someone harmless doing it for fun as they would probably just write messages and no be trying to insert URL's.

Either way best to remove it asap to reduce the chance you are marked as an easy target. I would ban those IP's, clean up the messages and put some CAPTCHA on, (doesn't have to be permanent, you can switch it on during periods of attacks).

  • 1
    The messages are posted from some 260 different IP addresses and new ones are used every day. CAPTCHA is already on, but clearly it is not working or the implementation is buggy allowing the scripts to bypass it somehow. The site in question has users with different disabilities and using a "proper" captcha will make some users struggle. – Paaland Mar 14 '11 at 9:45
  • 1
    Try a different CAPTCHA script, some work better than others against different attackers. Also, even though there are a lot of IP's I'd still block them all. Being proactive against it will deter the attacker even if it seems a bit pointless. – Tom Gullen Mar 14 '11 at 9:47
  • 1
    Thanks for the feedback. I'll block the IPs in question and switch to reCAPTCHA, atleast for the time being. – Paaland Mar 14 '11 at 9:53
  • 2
    @Paaland if you want to be creative, instead of blocking IP's you can fake a 'HTTP Error 500 - Internal Server Error' messages making the spammer believe the site is down. This might get your off their lists quicker. – Tom Gullen Mar 14 '11 at 9:55
  • 1
    Good idea. What's best though a 500 or a 404? Internal server errors might make them want to investigate further to maybe exploit a potential weakness or something. – Paaland Mar 14 '11 at 9:59

Usually, this kind of behavior can be explained in two ways:

First, it can be a test to discover vulnerabilities of your site, your application or your server. Forms can be really dangerous, they can open the door to your software or your server configuration. Several attacks try to guess whether your system is vulnerable by sending you requests including malicious code or strings.

But in your case, because I can see several [URL= strings, chances are the reason is pure SPAM. This is the typical spam request that is sent to forum, blog and guestbook modules.

In fact, the [URL= string is part of BB code, a common markup language used in blogs and forums used to post URLs. Spammers performs a high number of post request including URLs to generate back-links to their websites or to their clients' websites.

Chances are your contact form has been flagged as a kind of forum or blog.

Note. I originally posted this answer to this question, that was closed as duplicated of the current question.

Not the answer you're looking for? Browse other questions tagged or ask your own question.