Spam through online form

[Morledge]

Hi,

A client of mine is getting spam sent through his feedback submission form on his website.

Your Name: google
Telephone Number:
Email Address: google@google.com
Date of Hire: google
Chauffeur's Name: google
Event: School
Telephone Manner of the A Class Limos Telesales Staff :1
Competitiveness of the quotation given: 1
The Limousine & Chauffeur Service Promptness: 1
Courtesy: http://google.com
Cleanliness of the Limousine: 1
Journey - Unhurried and smooth: 1
Return journey: 1
If you contacted us during the evening how was your call or enquiry handled? http://google.com
Will you use us again?: 1

There is also a comments box which includes links to the search queries on www.avantfind.com which are, shall we say, illegal and wrong.

Does anyone know what could be happening? He receives about 5-6 a day.

Thanks

[DavidAllen]

As he is only getting 5/6 a day it is probably not an automated script doing it (which some simple CAPTCHA would stop). If the email address supplied by the spammer is the same (or similar) each time you could put something in the form processing to not send the feedback if that email address is used. You could also capture the IP address of the spammer and block that. Otherwise you can minimise the harm by stripping out the html tags from the comment field.
Regards
David

[eUKhost.com]

Even we were getting many such emails earlier and thats why we removed our php contact us page and pointed contact us link to the helpdesk. You can consider a captcha code or something which involves calculations by humans.

[Morledge]

Thanks, I have just quickly stopped processing anything from google@google.com for now. If he starts getting others then I will look into putting some sort of captcha solution.

Cheers

[hairyfreak]

The captcha solution would most likely be your best bet, as it would prevent automated scripts from using the form as a means of spamming, and would prove to be just a tiny inconvenience for genuine users of the form.

However, as you say, I would suggest only implementing one if the spam continues from another address.

[eUKhost.com]

wait for 2 days. emails will come from other addresses.

don't think that its me if that happens

[DavidAllen]

Make sure that when you don't process the email the spammer still gets taken to the thank-you page, so he (she?) doesn't know it's failed

[eUKhost.com]

They have policy of changing sending source frequently as we had marked google@google.com as spam source in our helpdesk but they managed to reach our helpdesk by changing sending IP and sender email address.