We run a sailing website and offer measurement forms for sails and what not -- recently we've been getting hit with hundreds of form submissions with random letters and names in the blanks and it's causing a massive headache! We tracked down to see if it was a certain bot or someone just trolling us but we tracked it down to a user with the ISP Googlebot and the IP is 66.249.66.### --

We recently did a bunch of 301 redirects and then reverted on those, and maybe that's what's causing Googlebot to be confused?

The measurement forms require an email to submit and we're getting random email addresses in the forms: screenshot for example --

Example form submission

Is our site compromised with a hack that's spamming Googlebot or is it just a mistake on our end? Any help would be greatly appreciated!

  • "ISP Googlebot" - ISP? If it is Googlebot, then you can publish the full IP. How is it "causing a massive headache"? – MrWhite Jul 26 '16 at 22:26
  • @w3dk It's mainly causing a headache due to the massive amount of spam email going into our order processing inbox. For example just this morning alone they received about 95 emails of just spam forms. Those are the ones that were sent to me -- all have the registered ISP of Googlebot – rpk-mps Jul 27 '16 at 13:44
  • It's certainly annoying (and unusual) that Googlebot would appear to be submitting these forms in such a way. Is the form GET or POST (and this is validated)? What happens when the form is submitted? What HTTP status is returned on success/failure? And what HTML response is returned? Googlebot will submit forms if it thinks it is able to access new/unique content. However, simple form validation should at least be blocking invalid submissions like the one shown in your question. And since this appears to be the Googlebot, you can block it in robots.txt. – MrWhite Jul 27 '16 at 14:37

That is a spambot filling out your form. Such bots scrape the web looking for forms to fill out and will fill any input elements with random junk.

You can get around that by using a "honeypot" that will catch any forms filled out that include a hidden input element that only bots would see. You would need to write code to reject such forms.

  • "include a hidden input element" - You have to be a bit careful with this technique. Whilst effective at blocking bots, you can also get false positives... real users that have form "auto-fill" enabled. Ideally, you would need to provide a secondary "human check" when the hidden field check fails. – MrWhite Jul 27 '16 at 8:20
  • Autofill won't fill an input named "fdjslazzz" – Rob Jul 27 '16 at 13:52
  • True, but a spam-bot is also less likely to complete such a form field. – MrWhite Jul 27 '16 at 14:10
  • Agreed, looks like a spoof. – The Brewmaster Jul 27 '16 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.