contact us form spamming

DivaVocals:

He gets spam because of this page: http://www.billholabmusic.com/contact-us/ where he has his email address on this page making him a target for scrappers/spammers.. Why have that page at all..Why not point that link to the Zen Cart Contact Us form??

Ha ha! Very good point. I'll ask him for an example of the spam which is supposedly coming through the ZenCart contact form and will see if maybe he's simply mistaken.

But, to clarify, his shop is running v. 1.5.4. I can see in the contact modules/pages/contact_us/header_php.php that there is some processing that checks for the hidden field. Also, there is no other php file in that directory.

What I was actually trying to understand is what is the processing SUPPOSED to do, not what it is doing on my client's site. Does it prevent the contact form info from being sent via email at all? Does it send it but mark it as spam in some way? Or does it do something else? Again, I am asking what is the ***expected ***behavior of this script natively in ZenCart so that I can compare it against what my client's site is doing.

Finally, is it also possible that some spammers have discovered this hidden field trick and have found a way around it?

earmsby:

Ha ha! Very good point. I'll ask him for an example of the spam which is supposedly coming through the ZenCart contact form and will see if maybe he's simply mistaken.

But, to clarify, his shop is running v. 1.5.4. I can see in the contact modules/pages/contact_us/header_php.php that there is some processing that checks for the hidden field. Also, there is no other php file in that directory.

What I was actually trying to understand is what is the processing SUPPOSED to do, not what it is doing on my client's site. Does it prevent the contact form info from being sent via email at all? Does it send it but mark it as spam in some way? Or does it do something else? Again, I am asking what is the ***expected ***behavior of this script natively in ZenCart so that I can compare it against what my client's site is doing.

Finally, is it also possible that some spammers have discovered this hidden field trick and have found a way around it?

First off, yes always possible. Hate to say it, but there is no solution that would 100% stop receiving email spam other than to stop receiving email... There's a few threads around here that discuss multiple ways to further reduce the likelihood of receiving it, but I don't really want to go into all of the other research that has been performed and published about spam reduction. Some of them may aggravate customers more than help the business others just become a game of cat and mouse to try to prevent the occasional spam, but that was a good catch by DivaVocals. I obviously was looking for the existence of a specific cause not for the reason.

As for "normal" process, what happens (and this is evident in code review) is that when the hidden field(s) are populated and the form submitted, if the field has data, then none of the actions to generate the email are performed and the "sender" is directed to the next location as if the email was successfully sent... Could compare a real contact us form email format to one of these "spam" versions to see what differences exist, though it would not be too surprising if there are some similarities because of the individuals trying to "get their message" out.. (or whatever it is that they are trying to do.)

Ok, so I was able to determine that the spam in question was actually coming from the zencart contact us form. But it turns out it's not the kind of spam I thought. It's not a bunch of gibberish like you see when a spambot is probing for a mailserver. Instead, it has a name and email and a message that has to do with some kind of business loan - more like advertising than spam.

I told the client that it's possible that a person is actually sending this unsolicited information but he still wants me to add a captcha to the form.

So I am back to trying to determine how to do that for this form. The module mentioned near the beginning of this thread only mentions dealing with spam during registration. Does anyone know if the mod also allows you to add a captcha to the contact us form or if there is any other mod that does?

earmsby:

Ok, so I was able to determine that the spam in question was actually coming from the zencart contact us form. But it turns out it's not the kind of spam I thought. It's not a bunch of gibberish like you see when a spambot is probing for a mailserver. Instead, it has a name and email and a message that has to do with some kind of business loan - more like advertising than spam.

I told the client that it's possible that a person is actually sending this unsolicited information but he still wants me to add a captcha to the form.

So I am back to trying to determine how to do that for this form. The module mentioned near the beginning of this thread only mentions dealing with spam during registration. Does anyone know if the mod also allows you to add a captcha to the contact us form or if there is any other mod that does?

What does the subject line of these suspect emails say EXACTLY.. Does the subject line of these emails say that they are coming from his Zen Cart contact us form???? That would surprise me if they do.. The captcha IMHO is unecessary if he is running the latest version of Zen Cart.. My years of experience and instincts tell me that the page which makes his email available to spammers/scrappers will ALWAYS make him vulnerable to spam no matter WHAT he does to the native contact us form..

The question is why does he feel he needs BOTH???

I hear what you are saying and personally I agree that it's not necessary. But on the other hand, my client is asking pretty pointedly for me to make a change to his contact us form. I have given him the various alternatives and he still prefers this solution. At this point, it seems to me that my job is do what the client is asking rather than continue to try to convince him that he's wrong.

By the way, I did compare the sample spam he sent me to a similar contact us form sent legitimately through my own zencart store and they were almost identical except for the name, email address and message. For what it's worth the subject line is "Website Inquiry from Bill Holab Music e-store." The subject line for my test in my own store is "Website Inquiry from Hildegard Publishing Store." As I said above, he is running the latest version and I have also double checked that the hidden field is in place and being checked by the script.

Would it really be a terrible thing to add the captcha to see if that cuts down on the spam? It seems to me the worst case scenario would be that he discovers that it doesn't help much and we remove it after a time.

earmsby:

I hear what you are saying and personally I agree that it's not necessary. But on the other hand, my client is asking pretty pointedly for me to make a change to his contact us form. I have given him the various alternatives and he still prefers this solution. At this point, it seems to me that my job is do what the client is asking rather than continue to try to convince him that he's wrong.
earmsby:

Would it really be a terrible thing to add the captcha to see if that cuts down on the spam? It seems to me the worst case scenario would be that he discovers that it doesn't help much and we remove it after a time.
If it were ME, I'd not want to spend time doing work that will not yield the result my client expects.. So I try to do my due diligence to solve my client's issues the first time when possible.. You handle things how you see best for your client.. I was only trying to help here..

Bottomline is that as long as he has his email address on his site, he will be vulnerable to scrappers and spammers.. He will continue to get spam, and you will have to explain again to him why the CAPTCHA doesn't really work.. Additionally there are usability studies which suggest that CAPTCHAs are barriers for customers..

There are CAPTCHA modules for Zen Cart.. install one of these modules..

earmsby:

By the way, I did compare the sample spam he sent me to a similar contact us form sent legitimately through my own zencart store and they were almost identical except for the name, email address and message. For what it's worth the subject line is "Website Inquiry from Bill Holab Music e-store." The subject line for my test in my own store is "Website Inquiry from Hildegard Publishing Store." As I said above, he is running the latest version and I have also double checked that the hidden field is in place and being checked by the script.Right.. Suggest you take a look at your client's "includes/languages/english/contact_us.php" file.. The default for the subject line is this:

define('EMAIL_SUBJECT', 'Website Inquiry from ' . STORE_NAME);

If you have NOT modified this for your client to look like this:

define('EMAIL_SUBJECT', 'Website Inquiry from ' . STORE_NAME . ' e-store');

Then these are SPOOFED emails, and they are not coming from the Zen Cart Contact Us form..

Good luck..:smile:

DivaVocals:

Right.. Suggest you take a look at your client's "includes/languages/english/contact_us.php" file.. The default for the subject line is this:

define('EMAIL_SUBJECT', 'Website Inquiry from ' . STORE_NAME);

> 
> If you have NOT modified this for your client to look like this:
> ```
define('EMAIL_SUBJECT', 'Website Inquiry from ' . STORE_NAME . ' e-store');

Then these are SPOOFED emails, and they are not coming from the Zen Cart Contact Us form..

Good luck..:smile:

Good point, however "e-store" is part of the STORE_NAME in this case. :)

I will make one last ditch effort to convince him that adding a CAPTCHA is not the right solution. I totally agree in terms of it being a barrier and I have advised other clients similarly. In this case, I think he only wants it on the contact us form not on the account creation or any other place where customers are actually in the process of ordering.

We shall see...

earmsby:

Good point, however "e-store" is part of the STORE_NAME in this case. :)

I will make one last ditch effort to convince him that adding a CAPTCHA is not the right solution. I totally agree in terms of it being a barrier and I have advised other clients similarly. In this case, I think he only wants it on the contact us form not on the account creation or any other place where customers are actually in the process of ordering.

We shall see...

Regardless as to where the barrier is, even on a contact us from, it may prevent customers from contacting the shop.. This could in turn lead to a lost sale/conversion.. Good luck.. Honestly he needs to remove ALL of those email links from his site, and funnel everything through ONE contact form..