Getting hit hard with spam through the "contact us" form

[cyburbia]

Today, I got hit with tens of drug spam messages throgh the "Contact us" form. All of it is from [email protected],. IP address of 85.255.117.18. Anyone else getting hit today?

[Wayne Luke]

Do you have the image verification for this turned on? It was added in 3.5.0.

[cyburbia]

Yes, I do. That's why it seems so strange; who would go thorugh the problem of verifying it just to send spam to one person?

A traceroute for 85.255.117.18 dies somewhere in West Virginia; not India like I'd expect for this type of spam.

BTW, I just got hit with nine more spams from 85.255.117.18.

[Reeve of Shinra]

ban the ip at the server level and in vb

[simsim]

Actually DNSStuff.com records shows that this IP belongs to a hosting company in Ukraine. They have an abuse e-mail which you can complain to.

See for details:

http://www.dnsstuff.com/tools/whois.ch?ip=85.255.117.18&server=whois.ripe.net&email=on

[cyburbia]

Actually DNSStuff.com records shows that this IP belongs to a hosting company in Ukraine. They have an abuse e-mail which you can complain to.

I just googled, and found that the IP is responsible for a LOT of spam. I doubt the hosting company is going to do anything about it.

[MrNase]

I am getting spam through that form from this IP: 84.19.186.155

I've turned the image verification for guests on so see if that helps.


The Spam I get uses the URL-BBcode and links to various subpages of http://[REMOVE]beliy.pbwiki.[REMOVE]com

[ManagerJosh]

Looks like nLayer is one of the primary backbones for this guy too.

[Reverend]

Today, I got hit with tens of drug spam messages throgh the "Contact us" form. All of it is from [email protected],. IP address of 85.255.117.18. Anyone else getting hit today?

I was hit by them for a few days.

In the
"Allow Unregistered Users to use 'Contact Us'" setting, make sure you have selected the "Yes, but verify image" option from the drop down.

I only had mine set to "Yes" not realizing there was another option to verify the image as well. Since applying that setting i haven't received any more spam.

[cyburbia]

I only had mine set to "Yes" not realizing there was another option to verify the image as well. Since applying that setting i haven't received any more spam.

That's the thing - I did have image verification turned on for the contact form. Seems like a LOT of trouble to go through just to spam one person.

As far as board registration goes, I've got most free Russian email providers and Yahoo.* among the banned addresses. Just blocking registration from Yahoo addresses stopped 95% of the spam that was posted.

EDIT: Amazing. My logs are showing a LOT of posts to vBulletin threads and nonexistent forms for other scripts I don't have (Moveable Type seems to be one of them) from 85.255.113.* to 85.255.117.* .

[cyburbia]

Looks like nLayer is one of the primary backbones for this guy too.

More stock graphics of the corporate-looking guy staring up at "endless opportunity" or something like that, with the usual skyscrapers in the background, along with liberal use of the word solutions. I don't trust companies like that, for some reason.

[Bob Isaac]

Does the 'contact us' form use the servers sendmail system?

Bob

[Quillz]

Does the 'contact us' form use the servers sendmail system?

Bob

I think it uses sendmessage.php.

[Colin F]

It uses sendmessage.php, which in turn uses the function you selected in your vBulletin Options, either mail() or SMTP.

[Bob Isaac]

Oh well, I had hoped I could use sendmail's blocking systems to deal with this.

Bob