Spammer using online contact forum and email

[Rose]

Hi everyone,

A friend of mine emailed me with this problem today. I suggested she post the question here to see if anyone has any advice to give. Then figured I'd just go ahead and ask for her.

She's suddenly getting spam email that's being generated from 2 of her websites through the use of her contact form that she has set up on the sites.

Basically, the email in the "from line" are variations of her email dxcytb@herdomain.com and the subject line is "HerDomain.com Contact Form" (which is how she has the subject line set up).

She contacted her webhosting company regarding this. Their reply was:
“Someone is using your email form to send mass email through our server. You need to use more secure mail software.”

She wanted to know what email program would be best to use as per the webhosting company's suggestion, however, the way I see it - how could someone use her form on her website to send mass spam emails unless they had access to her account? Or am I wrong with that assumption?

In any case, does anyone have any advice on what she could do to fix this? I told her to change her account password immediately to both websites.

[stephfoster]

They're probably using something called - there's a big problem with it going around right now.

[Baggs]

There is quite a friendly article about the problem here:

[Rose]

Thanks for the replies.

She read the info and it was all Greek to her, so she just removed the forms from her site and put in a simple, text, unlinked email address instead.

Truthfully, the articles were all Greek to me too so I wasn't much help to her either

[Jeff Casmer]

[faith]

Hi

I know your friend's problem was with a cgi script, but since he/she changed to just an email address, I though I'd help with that. As far as cgi goes, I think Matt Scripts' (linked in the Greek article) new cgi mail program addresses the spam issues, although it is much more complicated than the older version.

I persnally use these scripts to ward off spammers, so far it has worked well for me. I used it on a site that is no longer up and on my art site. So far the spambots (programs that automatically search for email addresses) don't interpret javascripts. I have never had a spammer find my real address from my websites. Just my stupid marketing trials that didn't work like FFA pages

Unfortunately, the spambots can read the text without a link too. They just search websites for anything with an @ symbol and can read the @ symbol code.

Also, I recommend your friend change her email address and remove the address that has been abused. After posting on the FFA networks, I was getting mail from me (administrator) to people that do not exist (i.e tom@newlifeforu.com) etc. threatening to cut off my service unless I gave my credit card number immediately. Unfortunately I had to send all the unrouted emails (i.e going to an invalid address) to :Fail:No Such Address Here (The real senders get an error) and loose my ability to create a new address on-the-fly. But it stopped the 100+ threats and viruses I was getting every hour! AARRRGGGH! Ya know, I still didn't get any real traffic.

Anyway, just replace the capitalized words with the information required, copy from scritp tag to script tag. Then place the whole script where ever you want the email link to appear.

I hope this helped. Please don't think I'm talking down. I just didn't want to speak Greek too or did you mean Geek. If you need more help let me know, I'll try.

Faith

Script one: This one displays a text link.

<script language=javascript>
<!--
var showtag="@"
var showlink="PUT YOUR LINK TEXT HERE";
var showname="PUT THE PRE @ ADDRESS HERE";
var showhost="YOUR DOMAINE.COM HERE";
document.write("<a href="+"mail"+"to:"+showname+showtag+showhost+
">"+showlink+"</a>")
//-->
</script>

Script two: This one displays a valid email address, but still in code:

<script language="Javascript">
<!--
username = "PUT THE PRE @ ADDRESS HERE"
server = "YOUR DOMAINE.COM HERE"

document.write("<font face='Arial,Helvetica' size=-1>");
document.write("<a href='mailto:" + username + "@" + server + "'>");
document.write("<font color='ff0000'>");
document.write(username + "@" + server);
document.write("</a>");
document.write("</font>");
//-->
</script>

[Lynn Terry]

Great post, Faith!

Welcome to the SSWT Forum

[Rose]

I use a PHP form (aformmail.php by Alex Scott), so I can't see adding the script you gave would work on my page as there is no email address on the contact page html code at all. I can't remember if I had used the same type of form for my friend's pages when I originally set them up or not...or if she had changed them later. I do remember we did have trouble with this code when we first tried it....so I might have just made a "typical" form for her with the email on the page.

Anyway, when someone fills out the form on my site, it calls the PHP script file:

<form name=request enctype="multipart/form-data" method="post"
action="nameofformhere.php">

But I'm going to hang on to a copy of that script you've provided. Thanks

[Dave Navarro]

I have 2 PHPbb forums, and I'm wondering if this is the source of the 100+ spam emails that get bounced back as coming from nonsense email addresses ending with my domain name.

[faith]

My form program was cgi, and I was convinced that that was my source, but for me, when further investigating, I noticed that ffa@ my domain was showing up as the sender or recipient a lot also. It could be that my program was also not secure and that the ffa sites were just how I was found.

PHP is not in my realm of knowledge yet, I wish I could offer more help.

If you have the ability to send all unrouted mail somewhere and are using apache, I suggest sending them into :blackhole: or the :fail:no such address I mentioned earlier. It immediately stopped the junk from filling up my default account. (I like the fail, because many spammers use tactics to see if an address is real. With that said I just might get to help fill up them with junk too.)

I have never used a MS server outside of college, so I can't help there either, but if your host is responsive maybe they can help.

Faith

[Rose]

Actually, I do send them into :blackhole. My problem with spam though is the main email address for my wedding site. I'd change it and then send those emails into :blackhole too....except that's what I used to sign up for my Adsense account. (stupid move on my part....hindsight is great ain't it?)

Unfortunately, you can't change your email with Google Adsense unless you send them an email asking to change it, then I believe they close your current account and reopen a new one with the new email you provided. So, I would then have to go through massive amounts of pages on all my sites and change my adsense codes to the account ones. Basically a huge pain in the hiney.

[Dave Navarro]

I understand - I've had my email address forever & get a ton of spam.

Now I use Mozilla Thunderbird to get my POP email - it has filters that are very to set up and it's a lot easier to route good email to the right folder. Much easier than with Outlook.

You should check it out and see if it's a good solution for you.

[Lynn Terry]

[Rose]

[Troy]