0

While there are lots of rules to id and ban spambots, e.g., Fail2Ban rules, it's always a cat-and-mouse chase. Nothing's perfect.

Then it hit me. The one thing they always do is get a page, then submit it < 5 seconds later. So the log is clear:

  • 12:00:00 GET (some page that's a form)
  • 12:00:01 POST (submission)

I'm guessing it would be impractical for a spambot to wait x minute(s) to submit, like a normal user would.

Thoughts?

Anyone know of an existing solution that can ban based on this logic?

Improve this question
2
  • 1
    Can you elaborate on your question? It looks to me, like your website(?) or API(?) don not have good protection from automated spam? This is a potentially broad topic, so please outline the whole picture if like to hear a proposal on how to help you
    – aholbreich
    Commented Apr 24, 2021 at 12:23
  • 2
    There are legitimate reasons to submit a form in under a second. If it's just a login form, it will likely be prefilled by the password manager. And even large forms can be filled in by form recovery plugins after they have been filled in manually before and then closed accidentally or submitted into a severed network cable and timed out.
    – John Dvorak
    Commented Apr 25, 2021 at 6:09

1 Answer 1

Reset to default
5

It could be possible to write some custom fail2ban rules to 95% solve this (ie with a short "findtime"). There might be edge cases with CGNAT and scripts but you can likely mitigate this by being specific about the form page to scan for, and it should be practical if your form is not getting 1000s of hits per hour from a targeted group. That said, Id only look at this type of solution if you cant modify the website code.

It would seem to me to be relatively straight forward (if your site is using something like php) to set a cookie/session for each form view which tracks the request time in seconds since the epoch. Some trivial code in the form could do a time comparison on the form processing to know if its spam.

An alternative solution to stymie a simple bot of the type that doesn't implement a wait is a captcha - even a trivial one.

With respect of the practicality of a spambot waiting before submitting a form, this would not be hard, and any half decent programmer could do this without a significant performance impact to the bot using multiple threads - of-course this does not mean they do.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.