[php] spam email

[ICT_GUY]

I use the following code to allow parents to email into the school while keeping the the email address hidden. Its a simple post form going to another php page with the following code.

 

$to = $_REQUEST['sendto'] ; 
$from = $_REQUEST['Email'] ; 
$name = $_REQUEST['Name'] ; 
$address = getenv('REMOTE_ADDR');
$headers = "From: $from"; 
$subject = "Email From School Website"; 
$today = date("d/m/Y");
$minutesseconds = date("l dS \of F Y h:i:s A");
$fields = array(); 
$fields{"Name"} = "Name"; 
$fields{"Regarding"} = "Regarding"; 
$fields{"Email"} = "Email"; 
$fields{"Message"} = "Message"; 
$fields{"address"} = "Recieved from Ip address $address this email was posted on $minutesseconds (add 6 hours for GMT time) "; 
$fields{"Sender"} = "This email was sent to $to"; 
$body = "We have received the following email via the school website:\n\n"; foreach($fields as $a => $b){ $body .= sprintf("%20s: %s\n",$b,$_REQUEST[$a]); } 

$headers2 = "From: [email protected]"; 
$subject2 = "Thank you for contacting "; 
$autoreply = "Thank you for contacting us. A member of staff will get back to you as soon as possible. If you have any more questions, please visit our website http://www.wykeregisjun.co.uk";

if($from == '') {print "You have not entered an email, please go back and try again";} 
else { 
if($name == '') {print "You have not entered a name, please go back and try again";} 
else { 
$send = mail($to, $subject, $body, $headers); 
$to ="[email protected]";
$send = mail($to, $subject, $body, $headers); 
$send2 = mail($from, $subject2, $autoreply, $headers2); 
if($send) 
{header( "Location: http://www.wykeregisjun.co.uk/sendingemail.php" );} 
else 
{print "We encountered an error sending your mail, please notify [email protected]"; } 
}
}
?>

 

Unfortunately we are getting a ton of spam being sent through. What I really need is a way of checking if the message contains "http://" and if it does then to not send the email and redirect to another page.

 

Any PHP gurus out there that can help please?

[Michael]

Is it because you have 'catch all' setup on the domain? You could periodically change the e-mail address the webform sends mail to.

[ICT_GUY]

Sorry I should have added the address for the email form.

 

Email Us « Wyke Regis Junior School

 

Either a bot is posting stuff into the form or directly to the contact.php page (which contains the above code) I suspect the former and I suspect that its actually a human copying and pasting into the form since the spam is just sent to random members of staff of the contact list. All of the spam is being sent via the contact code, I have included an example of the spam below.

 

Name: interracial xxx for you

Regarding: ChihqJjlVaU

Email: [email protected]

Message: comment6, EduGeek.net >Best xxx xxx Best xxx xxx, iucoj, NO CREDIT CHECK STUDENT LOAN Home Page >no credit check student loan now no credit check student loan now, 289, EduGeek.net >interracial xxx interracial xxx, 21759, Bad Credit Student Loans Home Page >Cheap bad credit student loans Cheap bad credit student loans, yaaiv, EduGeek.net >bbw xxx bbw xxx, 4218,

Recieved from Ip address 94.142.130.57 this email was posted on Wednesday 17th of February 2010 01:19:36 AM (add 6 hours for GMT time) :

 

A simple check to see if the message contains "http://" would stop all spam being sent.

[Michael]

You could in theory introduce CAPTCHA also. That would slow them down.

[ICT_GUY]

Yes that's one way of moving forward, though a quick verification of what's been entered would solve the problem straight away.

[ICT_GUY]

PHP Captcha Security

 

I will give this a go and see if it slows the stream of spam.

[Michael]

Good luck

 

It does make me wonder though if you're theory is right about someone manually copying/pasting; what's the point!!?

[dwhyte85]

It's not pretty but will do what you've asked, will need to fill your bits in, assumes $body is the main text of your e-mail from the sender.

 

$tofind = 'http://';
$pos = strpos($body, $tofind);

if ($pos === FALSE) {

//not found, do sendmail
} 
else {

// report URL found
}

[ICT_GUY]

Good luck

 

It does make me wonder though if you're theory is right about someone manually copying/pasting; what's the point!!?

 

Its a gut feeling after seeing the emails come in from various sites, they are irregular and always look as though someone is randomly filling in the form. Probably some kid in a deprived country as cents per day.

[ICT_GUY]

It's not pretty but will do what you've asked, will need to fill your bits in, assumes $body is the main text of your e-mail from the sender.

 

$tofind = 'http://';
$pos = strpos($body, $tofind);

if ($pos === FALSE) {

//not found, do sendmail
} 
else {

// report URL found
}

 

I will try this on another site this week to see if it works. I am also trying out the captcha. I will see which one works best.

[dwhyte85]

You can find sites online that will do it!

 

Could create a func for checking any URL checking .net .co.uk .org.uk as they may have no https/https prefix. Have an array of prefixes/TLD/ Search terms and have a counter for every time a criterion is met, then you could have a score based block :-p (return the counter from func)

Edited February 22, 2010 by dwhyte85

[rlweb]

You could just check the referrer and say if they came from this page send email.

[dwhyte85]

He isn't posting e-mail address to send to so it isn't being hijacked (I assume).

[ICT_GUY]

He isn't posting e-mail address to send to so it isn't being hijacked (I assume).

 

No, they are coming through the contact form. It logs times and ip addresses (in case of abusive emails from the public).

[ICT_GUY]

Captcha is working great, 12 in the space of an hour filtered.

[ICT_GUY]

Just a quick update,

 

The spam was being sent directly to the script, (at least it looks like it is) bypassing the entry form. The Captcha works like a charm, though I am going to try the http:// blocker on my own site.

[ICT_GUY]

Well something interesting has come of this, I now have identified where the spam bot lives and who their ISP is. 94.142.130.57 which is an un-configured webserver. The ip address belongs to CSS GROUP an isp in Latvia. I have sent a request to shut the offending customer down just to see if they will do anything.

 

No bored at work or anything.

[dwhyte85]

Have you nmap'd the server?

[ICT_GUY]

I have been reading up on .htaccess and by using "deny from 94.142.130" I can block that particular ip range.

 

I will see if it works though the Captcha seems to be working very well so far..

[Martin]

Vaguely relevant, but you have spelt "Received" incorrectly in the line...

 

$fields{"address"} = "Recieved from Ip address $address this email was posted on $minutesseconds (add 6 hours for GMT time) "; 

 

mb

[ICT_GUY]

That would be my usual spelling rules creeping in, thanks I shall fix it