🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: demon.service
Article #28

Strange attempt at spamming me

#28
From: David Gibson
Date: Sat, 07 Aug 2004 11:16
37 lines
2757 bytes
I have experienced a rather strange attempt to 'spam' me, which readers
might be interested in.

I maintain an online directory of information at
http://www.caves.org.uk/ and it includes a form for people to e-mail me
with additions and changes to the information.  The form is processed in
PHP and it assembles an email containing the information, which it mails
to my Demon account.

Recently I have been receiving requests for me to add an entry to my
directory that was *completely* off-topic. No amount of notices on the
form submission page seemed to stop this from happening. People must be
amazingly stupid I thought.

Then I looked at the responses in more detail and decided that they were
all machine-generated. Although they were on different subjects, they
followed a similar format, and came from one of a small group of
servers.  The telling thing was that the response allocated a value to
the variable associated with my submit button, which a true manual
response could not possibly do.

Using the above observation, Ive written a filter that rejects forms
that do not have the correct value associated with the submit button.

But this is a strange form of 'spam' is it not?  

I suppose that if you flooded the Internet with your machine-generated
form responses, a few might make their way, unmoderated, on to web
pages. But it seems a very long shot to me, and the level of the
spamming seemed too low for it to be a real commercial operation. Its
dried up completely now.  Just a hacker messing around, perhaps?

Follow-ups to demon.homepages.authoring

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.
Technical Details
Message-ID: <0mVLvOABoLFBFwiH@[127.0.0.1]>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!proxad.net!proxad.net!194.159.246.34.MISMATCH!peer-uk.news.demon.net!kibo.news.demon.net!news.demon.co.uk!demon![127.0.0.1]!david-4

Show Full Headers
Complete Article Headers
X-Google-Thread: fad9d,bf030bd022a3580a,start
X-Google-Thread: f76f2,bf030bd022a3580a,start
X-Google-Attributes: gidfad9d,gidf76f2,public
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!proxad.net!proxad.net!194.159.246.34.MISMATCH!peer-uk.news.demon.net!kibo.news.demon.net!news.demon.co.uk!demon![127.0.0.1]!david-4
From: David Gibson <david-4@[127.0.0.1]>
Newsgroups: demon.service,demon.homepages.authoring
Subject: Strange attempt at spamming me
Followup-To: demon.homepages.authoring
Date: Sat, 7 Aug 2004 12:16:17 +0100
Organization: Domain name in From address is a black hole.
Lines: 37
Message-ID: <0mVLvOABoLFBFwiH@[127.0.0.1]>
Reply-To: David Gibson <david-12.spam.delete@mcrosolv.demon.co.uk>
NNTP-Posting-Host: mcrosolv.demon.co.uk
Mime-Version: 1.0
X-Trace: news.demon.co.uk 1091909320 25132 158.152.35.188 (7 Aug 2004 20:08:40 GMT)
X-Complaints-To: abuse@demon.net
NNTP-Posting-Date: Sat, 7 Aug 2004 20:08:40 +0000 (UTC)
X-Newsreader: Turnpike Integrated Version 4.02 U <E9+5V2g0BvDGmce1vsf5$x$rH2>