Article View: demon.service
Article #28Strange attempt at spamming me
From: David Gibson
Date: Sat, 07 Aug 2004 11:16
Date: Sat, 07 Aug 2004 11:16
37 lines
2757 bytes
2757 bytes
I have experienced a rather strange attempt to 'spam' me, which readers might be interested in. I maintain an online directory of information at http://www.caves.org.uk/ and it includes a form for people to e-mail me with additions and changes to the information. The form is processed in PHP and it assembles an email containing the information, which it mails to my Demon account. Recently I have been receiving requests for me to add an entry to my directory that was *completely* off-topic. No amount of notices on the form submission page seemed to stop this from happening. People must be amazingly stupid I thought. Then I looked at the responses in more detail and decided that they were all machine-generated. Although they were on different subjects, they followed a similar format, and came from one of a small group of servers. The telling thing was that the response allocated a value to the variable associated with my submit button, which a true manual response could not possibly do. Using the above observation, Ive written a filter that rejects forms that do not have the correct value associated with the submit button. But this is a strange form of 'spam' is it not? I suppose that if you flooded the Internet with your machine-generated form responses, a few might make their way, unmoderated, on to web pages. But it seems a very long shot to me, and the level of the spamming seemed too low for it to be a real commercial operation. Its dried up completely now. Just a hacker messing around, perhaps? Follow-ups to demon.homepages.authoring -- David Gibson Spam-cloaked message: The Reply-to: address *is* valid.
Technical Details
Message-ID:
<0mVLvOABoLFBFwiH@[127.0.0.1]>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!proxad.net!proxad.net!194.159.246.34.MISMATCH!peer-uk.news.demon.net!kibo.news.demon.net!news.demon.co.uk!demon![127.0.0.1]!david-4Show Full Headers
Complete Article Headers
X-Google-Thread: fad9d,bf030bd022a3580a,start X-Google-Thread: f76f2,bf030bd022a3580a,start X-Google-Attributes: gidfad9d,gidf76f2,public X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!proxad.net!proxad.net!194.159.246.34.MISMATCH!peer-uk.news.demon.net!kibo.news.demon.net!news.demon.co.uk!demon![127.0.0.1]!david-4 From: David Gibson <david-4@[127.0.0.1]> Newsgroups: demon.service,demon.homepages.authoring Subject: Strange attempt at spamming me Followup-To: demon.homepages.authoring Date: Sat, 7 Aug 2004 12:16:17 +0100 Organization: Domain name in From address is a black hole. Lines: 37 Message-ID: <0mVLvOABoLFBFwiH@[127.0.0.1]> Reply-To: David Gibson <david-12.spam.delete@mcrosolv.demon.co.uk> NNTP-Posting-Host: mcrosolv.demon.co.uk Mime-Version: 1.0 X-Trace: news.demon.co.uk 1091909320 25132 158.152.35.188 (7 Aug 2004 20:08:40 GMT) X-Complaints-To: abuse@demon.net NNTP-Posting-Date: Sat, 7 Aug 2004 20:08:40 +0000 (UTC) X-Newsreader: Turnpike Integrated Version 4.02 U <E9+5V2g0BvDGmce1vsf5$x$rH2>