7

We're receiving a lot of spam that looks like this:

Form field 1 (textfields): duYYAJPNaMVsC

Form field 2: icDiQOVRy

Form field 3: uSDzPEObWIrTsCidma

Form field 4: ODscxPiiqj

Form field 2: (textarea) 6YWx4t yykqtykkniwr, [url=http://nvuozttudquw.com/]nvuozttudquw[/url], [link=http://xnwfrkyueend.com/]xnwfrkyueend[/link], http://efuwqygexlaj.com/

What kind of spam is this and what purpose does it have? The links doesn't work and it's not advertisement.

3

They're probably just testing your form to see if it is vulnerable. If it succeeds your site probably gets added to an automated tool and then will get "normal" spam on a regular basis.

  • How do you think they measure "success"? I run a lot of sites each site receives a couple of these / month. – Emil S. Apr 5 '11 at 8:49
  • 1
    @Emil, That depends on what they are trying to accomplish exactly. If it's to publish spam then they look for that. If it's to send spam emails then they'll look for that. – John Conde Apr 5 '11 at 11:43
2

The spammer is probably following this pattern, adapted from legitimate SEO folks who test Google indexing:

  1. Find a few long strings that return no Google results.
  2. Submit the strings to your form
  3. Search Google to see if the content shows up in the search results now
  • A few years ago a friend and I invented a word that we each placed on our site in a test to see who could get higher in search results. I lost :o) – Steve Jan 3 '17 at 22:48
1

I all of a sudden started getting spam like that from one of my contact us forms. It included links (that I was cautious to never click on). The inputs contained gobbly-gook like your example.

I created a home baked captcha-ish solution: "What was the color of Napoleons' White horse?" If the answer was "White" then my server sent me the email.

Spam went away--which like I suspected--was caused by an automated bot.

I've seen other tests like this. For example, asking what the sum of 2 numbers is.

  • Employing better form validation can often avoid some of this spam without necessarily having to resort to a captcha-like human test. – MrWhite Jan 3 '17 at 20:21
  • I agree. But been there done that. A word rich input form that allows links makes it really hard to easily validate. Length? no problem. email? you need a lot more resources to really validate an email address than I wanted to implement. – JustJohn Jan 3 '17 at 22:44
  • I might even add a JavaScript version so as to avoid any of the server's time when rejecting a submission. Yes, I know it would be visible to a human with "View Source". – JustJohn Jan 3 '17 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.