About 3-4 weeks ago we had around 25 form submissions in at work for one department. However every field entry was *random set of letters*@thewebdomain.co.uk. Mildly annoying to most but much more to us as our forms are submitted straight to the recruitment database and it left me having to manually delete each one by searching on the 'email address' used.
I didn't think much more about it until about 2 weeks ago when it happened again on another of the department sites. This time I started figuring out error traps to prevent this from causing as much of a problem. I also traced the IP of the perpertrator and emailed the abuse@ address of the company running the IP range. I've also now seen others having similar problems and it's all the same script that's doing the work. Some of these form submissions get a mixed up email header going in as well, with the MIME type being described and you can see that the bcc address within this mess is an aol.com email address. Whether this is the original script writer or if it's some poor sod who's been caught in the crossfire who knows.
I'm also wondering whether this script is being run by bots stored silently on computers around the world as we're now getting hit about twice a day at work and every IP trace sends me to another country. I realise the bots could be hacking an IP but I'm wondering if the owners of the PCs don't realise that these bots are running in the background. At this point can I just recommend to everyone to either at least enable their XP firewall (if running XP) or go and download one of the many firewalls out there, free or purchased. ZoneAlarm, Kerio and Sygate are all perfectly fine. These will prevent bots from executing on your machine and accessing the internet!
So I've now got error traps in place that reroute the email to a spam box for checking over. However looking through the log files of the web server, this bot also doesn't have a useragent defined, so my first job for Monday will be to add in a few lines of script at the top of each form mailer saying "if no useragent defined then boot them to google". I don't have time for faffing about with Spammers, I've got a job to do!!