3

Can I use .htaccess to kill any message coming from a Tor IP, or should I make a script on my mailer?

I've got

$IP = $_SERVER['REMOTE_HOST'] ?: gethostbyaddr($_SERVER['REMOTE_ADDR']);

and I checked one of the mails against my Tor IP list and did find a match: ns3035851.ip-37-187-94.eu

List of IP addresses

|improve this question
2

Instead of using an IP address blacklist (which is like playing a losing game of whack-a-mole), I might recommend one of two strategies for curtailing bot spam:

Strategy 1: Honeypot field

I use this for one of my own web forms personally, and it works very well. The idea is to create an anti-spam field in your form, where if that field is filled in (it will be filled in indescriminantly by a bot), your system automatically marks the submission as spam.

You can hide the honeypot field from legitimate users by giving it a zero (or low) height in the browser along with overflow: hidden. In case a user has CSS disabled, you can give the field a label something along the lines of "anti-spam - please leave this field blank".

Strategy 2: Captcha

An alternative strategy is to use a captcha, making it so only humans can submit your form. The most popular captcha solution is ReCaptcha, which can be easily integrated into a web form.

|improve this answer
  • Honeypot i was going to try but there are 4 fields and the only ones hes using is name and email. im going to try some required fields on the phone number and see how that works. i hate captha – james gasrdner Nov 29 '18 at 22:02
  • 1
    I slight caveat with the "honeypot" (hidden field) is that it can also catch real users that use an auto-complete browser feature. You can partially get around this by using an obscure control name, but the idea of using a honeypot like this is that you use a recognisable name to catch the bots. You could implement this as the first line of defence (as it is reasonably effective and not in the way of the user), but prompt with a Captcha if this test should fail. (Also avoids always prompting with a Captcha.) – MrWhite Nov 29 '18 at 23:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.