It's been about 2 months since I implemented my last anti-spam form submit code and surprisingly the spammers were stopped dead this time and don't seem to have a clue how to get around it.
Without giving away all the secrets so the little pecker heads don't read this and figure it out, it's a combination of javascript in the browser and some server side tracking algorithms that seem to be able to detect the spam scripts very accurately.
Looking at my log today the spammers may have just given up on my site because the ton of failed posts no longer appears.
Here's a few highlights of the last anti-spam patch:
- No captcha that a human must type as the javascript itself is the captcha
- Browser and user agent validation
- Data center blocking
- Behavior profiling
The cute thing with the javascript
captcha code is that it automatically builds a series of letters in a value that's posted back to the server. Each time something is entered into a field, meaning a human manually typing in a name, email address or comment, the javascript code adds another letter to the internal
captcha string. Basically how it works is the human entering data into the form automatically creates the
captcha answer returned as a form value.
The way the javascript is written it's nothing that happens the exact same way twice and the results are always different so I'm sure they gave up trying after a bit because the first
wrong answer submitted and I froze the form from being used again. This stopped the spammers from hacking at the code as one wrong move and they were locked out for 24 hours before they could attempt it again.
Unfortunately, I might've locked out a couple of humans with javascript disabled as well but I can't tell as the volume of form submissions looks normal, no obvious decline, and the page clearly states that javascript must be enabled in order for the form to work.
I think a few minor casualties are acceptable for my peace of mind and less work cleaning up spammers messes.
Bye bye spammers, nice know'n ya!