Contact us = spam messages

I noticed in the last week or so, that I am getting many spam messages through the Contact us page. Most of them are in foreign language (Russian or something like that) but some are in English and totally unrelated to the store content.

Is there a way to filter those or is it something I might have forgotten to set up? I never had that happen before, so I am a bit puzzled.

CaroleAs:

I noticed in the last week or so, that I am getting many spam messages through the Contact us page. Most of them are in foreign language (Russian or something like that) but some are in English and totally unrelated to the store content.

Is there a way to filter those or is it something I might have forgotten to set up? I never had that happen before, so I am a bit puzzled.

Post#13 in this thread has a solution. https://www.zen-cart.com/showthread.php?93026-prevent-people-from-using-contact-us-for-spam/page2

Thank you!

I'm wondering if this solution isn't working any longer. The latest versions of ZC already incoporate a hidden field into the contact us form. And yet, we are still being bombarded with mostly Russian spam through the Contact Us form.

For the heck of it, I followed the instructions on Post #13 from your link above (by adding yet another hidden field), but this hasn't stopped the spam from coming.

Is anyone else using 1.5.5f still experiencing a high amount of spam coming through the Contact Us form (and mostly from Russia spambots)?

I still have 1.5.5e and although i followed the instructions on that other thread, it didn't stop any spam email.
Any other ways to get rid of them?

Jeff_Mash:

I'm wondering if this solution isn't working any longer. The latest versions of ZC already incoporate a hidden field into the contact us form. And yet, we are still being bombarded with mostly Russian spam through the Contact Us form.

For the heck of it, I followed the instructions on Post #13 from your link above (by adding yet another hidden field), but this hasn't stopped the spam from coming.

Is anyone else using 1.5.5f still experiencing a high amount of spam coming through the Contact Us form (and mostly from Russia spambots)?

Keep in mind that not only are we talking about the hidden field, The code is open source! So yes its possible to teach our bots to look for that field and not use it..

You should change its name to something that seems common but not used in your site like dog_color, or URL and so on...

The field name if you are not sure is in the includes/templates/YOUR_TEMPLATE/templates/tpl_FORM_NAME.php
look for 'should_be_empty' and change it!

Then in includes/modules/pages/PAGE_NAME/header_php.php
look for and match 'should_be_empty' the what you used in the form.

$antiSpam = isset($_POST['should_be_empty']) ? zen_db_prepare_input($_POST['should_be_empty']) : '';

The same line is also in the includes/modules/create_account.php page

If you can use something like gedit to search in all files for 'should_be_empty' you can catch them all.

The other possible walk around is simply human bots are getting paid to click and enter can spam and hit the send button! Some just think this is a good way of advertising there bull, For them you can use a email address blocker.

Good info Dave!

Don't forget the tpl_product_reviews_write_default.php

We added a global cpanel email filter to check for a few most common Russian characters & auto delete. There was already a filter for Chinese characters.

We have around 25,000 russian IP addresses denied - using IP Deny (although we manually edited htacess to get all these loaded). Similarly, a further 20,000 odd other IP's denied from known rogue regions (ukraine, korea, belarus - and similar).
Whenever we get a website-generated message from a (russian) bot, we add the IP (or IP range) to the htaccess file.
This has helped enormously in keeping many rogues away.
Anyone know of a global database of IP locations? If so, would be nice to create a htaccess block to deny all of these rouge countries - with russia at the top of that list...

schoolboy:

Anyone know of a global database of IP locations? If so, would be nice to create a htaccess block to deny all of these rouge countries - with russia at the top of that list...

Something like this?
http://www.wizcrafts.net/htaccess-blocklists.html

or this
http://www.wizcrafts.net/iptables-blocklists.html

schoolboy:

We have around 25,000 russian IP addresses denied - using IP Deny (although we manually edited htacess to get all these loaded). Similarly, a further 20,000 odd other IP's denied from known rogue regions (ukraine, korea, belarus - and similar).
Whenever we get a website-generated message from a (russian) bot, we add the IP (or IP range) to the htaccess file.
This has helped enormously in keeping many rogues away.
Anyone know of a global database of IP locations? If so, would be nice to create a htaccess block to deny all of these rouge countries - with russia at the top of that list...

I use the IP deny that's included in my cpanel to add ip's to the root htaccess to cover both ZC and WP.. For blocking hack attempts and not spam.. As RixStix, I find good spamassassin rules works better for spam!

You can get that 25k down to 5k.. Our host suggested this site if we wanted to block countries.. ip2location(DOT)com/free/visitor-blocker

Of course, IP's can be faked, anonymized, and they can use shell accounts!

Something like lat9's "restrict digital downloads" plugin

https://www.zen-cart.com/downloads.php?do=file&id=1933

which uses the IP2location lite list. Even using the paid version of the list would be worthwhile to come installations.

Might be beneficial but could foul up a cart if used improperly

davewest:

Keep in mind that not only are we talking about the hidden field, The code is open source! So yes its possible to teach our bots to look for that field and not use it..

You should change its name to something that seems common but not used in your site like dog_color, or URL and so on...

The field name if you are not sure is in the includes/templates/YOUR_TEMPLATE/templates/tpl_FORM_NAME.php
look for 'should_be_empty' and change it!

Then in includes/modules/pages/PAGE_NAME/header_php.php
look for and match 'should_be_empty' the what you used in the form.

$antiSpam = isset($_POST['should_be_empty']) ? zen_db_prepare_input($_POST['should_be_empty']) : '';

> The same line is also in the includes/modules/create_account.php  page
> 
> If you can use something like gedit to search in all files for 'should_be_empty'  you can catch them all.
> 
> The other possible walk around is simply human bots are getting paid to click and enter can spam and hit the send button!  Some just think this is a good way of advertising there bull, For them you can use a email address blocker.
I have done this and no more spam today or yesterday :smile:

Thank you, took all of 5 minutes 11 files,,,

I changed mine to "Stupid_Hackers_When_Will_They_Learn"

Just copy what you want to change it to, then basically double click and Control V

mespe:

Thank you, took all of 5 minutes 11 files,,,

I changed mine to "Stupid_Hackers_When_Will_They_Learn"

Just copy what you want to change it to, then basically double click and Control V

Security through obscurity is not security but just to fool the owner. Which I assume you missed reading the first line of my comment..

Keep in mind that not only are we talking about the hidden field, The code is open source! So yes its possible to teach our bots to look for that field and not use it..

First, this is about bots not ‘hackers’ who Wikipedia lists as a skilled computer expert that uses their technical knowledge to overcome a problem! A term which would fit most of the coders here.

Some basic bots are open source and can be used for a lot of different tasks. Which also means we can learn form the bots to create better honey-pots.

I followed the link on post #2 of this thread, and followed the instructions listed on tha tpost #13 but I am still getting 20-30 spam emails per day.

What else can be done?

CaroleAs:

I followed the link on post #2 of this thread, and followed the instructions listed on tha tpost #13 but I am still getting 20-30 spam emails per day.

What else can be done?
without posting a link so we can look at your code, we would be guessing at what the problem is. There are different levels of honeypot code, you can use more then one on a page which would swat most bots. The highest level would be redirecting back to the form page for a final review before the user would send.. Human bots require blocking domains or addresses. Blocking IP's get even more, but your list can get very large. Adding good rules to your server SpamAssassin works wonders. Hosts that keep email servers up to date really help. Good server firewall rules help..

*CAPTCHA *would be my last option, there not bot prof, they tend to piss off old folk like me and there not always 508 complainant. If I had to do one, it would be on site code and not off site due to tracking issues.

davewest:

without posting a link so we can look at your code, we would be guessing at what the problem is. There are different levels of honeypot code, you can use more then one on a page which would swat most bots. The highest level would be redirecting back to the form page for a final review before the user would send.. Human bots require blocking domains or addresses. Blocking IP's get even more, but your list can get very large. Adding good rules to your server SpamAssassin works wonders. Hosts that keep email servers up to date really help. Good server firewall rules help..

*CAPTCHA *would be my last option, there not bot prof, they tend to piss off old folk like me and there not always 508 complainant. If I had to do one, it would be on site code and not off site due to tracking issues.

Do you mean a link to my site? Here: http://creationcassel.com/store/

As for the other options you are listing. how do I implement that? I am not a coder. I can follow instructions though so if there are lists of instructions somewhere to install such a "honey pot" or implementing a "redirect", I'd be happy to follow them.

Are you sure the spam is coming from the contact page? As your mail address is shown in plain sight on the front page of your store.> CaroleAs:

Do you mean a link to my site? Here: http://creationcassel.com/store/

As for the other options you are listing. how do I implement that? I am not a coder. I can follow instructions though so if there are lists of instructions somewhere to install such a "honey pot" or implementing a "redirect", I'd be happy to follow them.

Design75:

Are you sure the spam is coming from the contact page? As your mail address is shown in plain sight on the front page of your store.

Hum... that is a good point. However, all the emails i get are showing the same "subjects" like:

Website Inquiry from Creation Cassel
or
Demande de renseignements du site Web Creation Cassel

However, I justl changed the address on that main page, to see which one is sending the emails. I'll report back in a few hours probably.

But if they still do come from the Contact Us page, what could be done? or looked into?