My website has a nice by-design anti spam protection. Originaly it was a mistake. What I did is, that every AJAX-submitted <form> has method="get" but AJAX actually uses POST.

Thanks to this, every spam so far has been dumped in invalid_requests.log. Today, 7 fake emails passed suddenly. Further more, they do not contain malicious links or Viagra advertisement. Just completely irrelevant messages:

From at 12:49:24

Hello. Adopting a child with special needs has been on our hreats and in searching, I came across this site. I went and looked at the Rainbow website and was so touched. A little girl named Beatrice tugged at my heart in a way I never felt and little Ashlyn. Although we can afford to have them, I had no idea it would cost so much to adopt a special needs child. I am feeling torn as there is no way we could but I feel as though God has led us to. Any advice?

If you google that message you'll notice that the word hearts is intentionally malformed randomly to make sure simple comparison doesn't identify two of these messages as same.

From at 9:11:47

Good luck Elle!! These kinds of diets are always eelmxrety risky, so be careful. The minute you start eating carbs again you're risking gaining all that weight right back. My best advice for you, from my experience, is moderation. Look up portion sizes online & make sure you're eating the right foods with the right complimentary foods. You should be eating foods long-term that are a lifestyle change, not just a one week thing, just because your body is going to get used to eating in a new way and then get really upset when you re-incorporate that food you stopped eating! But in any case, good luck & I hope it works for you The toughest thing for me to kick is chocolate, for SURE. I've tried, but I always somehow managed to eat a little bit haha. For shame!!

This second message doesn't appear anywhere on the internet. But again, one word extremely is malformed.

My question is: Do you have any experience with this kind of attack? Why is every IP different? What's the point of these messages? Are there some algorithms that could allow me to filter or at least raise a warning flag on these posts?

  • Looks like reply back spam... Mar 27, 2015 at 12:31
  • @bybe But what is the purpose of this? It provided fake e-mail addresses (pattern [a-z0-9]{8,12}@gmail.com) but I don't think they are even real... Mar 27, 2015 at 14:08
  • 1
    It could just be a test to see what response code it gets. It may be that the to: address is a hacked e-mail account or not. It does not matter necessarily. They may only want to know that they can post to your application.
    – closetnoc
    Mar 27, 2015 at 15:20
  • "This second message doesn't appear anywhere on the internet." - although the malformed word does, and if you simply Google this one uniquely malformed word you immediately find a bunch of sites that are vulnerable to this kind of spam-attack and don't clean up their comment spam. (Like what closetnoc says.)
    – MrWhite
    Mar 27, 2015 at 15:50
  • Ah, Sorry... I skimmed through the question too quickly. It's likely a broad form test to see if the bot can post content to the page, it'll use several methods to do so, and some even can learn. It'll check for things like if moderation is required. Also, black hat SEO isn't just about back links. Branding words, product mentions, and even the telephone number of a company can increase rankings. The IP changes due to the fact that the likes of Akismet and other spam blocking networks block users, scrapbox for one example can use unlimited proxies. Mar 27, 2015 at 18:19

1 Answer 1


Its a test of your spam protection, for more spam coming.

  • I'm voting this answer down because it is so short. Please edit this to expand on this. How do you know this? What type of spammers do this? Mar 23, 2017 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.