Blocking spam registrations with name fields

Published by neil on June 13th, 2008

Britcaster.com - the original home of the Uk’s podcaster community - still ticks over in a lazy backwater of the internet receiving a handful of new show registrations each week. It also receives twice as many spammer registrations - but not any longer.

Spammers use any and all online forms in an attempt to create a link to their website(s) from as many places on the internet as they can manage. If you are puzzled as to the reason, it is all about the battle to show up higher on search engines by manipulating one of the most important factors: the number of sites that link to yours.

In the past, most of these bogus form submissions and site registrations were automated. Coded ‘bots’ are sent out to scour the internet, following links, seeking suitable forms, filling out the details, and submitting the false data. There are relatively easy to block through the use of CAPTCHA images - those slightly obscured letter and number combinations you so frequently see on registration forms these days. There are other techniques to help prevent automated submissions, but recently there has been a marked increase in the umber of real human submissions. These, of course, are a great deal harder to block.

Clearing out the spammer registrations at Britcaster over recent months, I started to notice a trend and monitored how the submission were being made. This provided a very straightforward to block every spam submission, without the need for CAPTCHA images or clever javascripts, images, or complex coding under the hood.

What I spotted

The registration form has two fields for the registrant’s name: Firstname, and Surname. In every single spam registration the spammer placed an identical name in both of those fields. The solution was to look at those two fields, and if they matched, block the form submission! Couldn’t be easier and spammer registrations have reduced to zero. One important consideration is when you find the matching name fields, do not present a validation error explaining the problem, simply cut off the form submission with some kind of obscure, fatal error.

There is a flaw in this, of course. I’ve now posted about this and if word spreads, it may get picked up by spammers and they change their tactics. But I’d rather take that risk and spread the word about this very simple technique to thwart their efforts for at least a little while.

Tags: registration, security, spam, spammers
Posted in TechGeek |