乱码垃圾邮件 - 这是什么意思？
似乎有一个机器人试图通过我的联系表单发送垃圾邮件 - 试图发送数百封纯属胡言乱语的电子邮件：
1vvQZe mnfxobzahiga，[url=http://dxicyigwtdyn.com/]dxicyigwtdyn[/url] , [link=http://hhulyjnulbvz.com/]hhulyjnulbvz[/link]< /a>, http://nfggzmenyqcl.com/
我真的试图避免在我的网站上使用验证码，但是这个越来越荒谬了。
- 谁能准确解释这些垃圾邮件发送者想要做什么？
- 我可以通过什么非验证码长度来检测它们？请记住，他们每封电子邮件都会切换 IP
There seems to be a bot attempting to spam through my contact form - attempting to send hundreds of emails with PURE gibberish:
1vvQZe mnfxobzahiga, [url=http://dxicyigwtdyn.com/]dxicyigwtdyn[/url], [link=http://hhulyjnulbvz.com/]hhulyjnulbvz[/link], http://nfggzmenyqcl.com/
I'm really trying to keep from using captchas on my site, but this is getting ridiculous.
- can anybody explain exactly what these spammers are trying to do?
- what non-captcha lengths can i go through to detect them? keep in mind that they are switching IP's every email
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
大多数现代垃圾邮件过滤器通过某种形式的贝叶斯分析来工作 http://en.wikipedia.org/wiki/Bayesian_analysis
如果这些邮件没有触发垃圾邮件过滤器作为“坏”邮件，它们最终将进入“好”过滤器，对未来的真实垃圾邮件邮件（伟哥广告或尼日利亚骗局或其他内容）进行加权，其中也包含相同的乱码。因此，他们会在您的垃圾邮件过滤器中植入种子，以便稍后可以通过。
通过简单的谷歌搜索，我的想法很快得到了许多网站分析的支持。例如，请参阅 http://ezinearticles.com/?Gibberish-Spam-Email---Why-Do-Spammers-Send-It?&id=573584
Most modern spam filters work by some form of Bayesian Analysis http://en.wikipedia.org/wiki/Bayesian_analysis
If these messages don't trigger the spam filter as "bad" they will end up in the "good" filter, weighting a future real spam message (Viagra ad or Nigerian scam or whatever) which also contains the same gibberish. So they are seeding your spam filter so they can get past it later.
My thoughts were quickly supported by analysis on many sites through a simple Google search. See, for instance, http://ezinearticles.com/?Gibberish-Spam-Email---Why-Do-Spammers-Send-It?&id=573584
回复：非验证码：
1）很多时候这些机器人尝试为每个输入提供一个值。因此，向您的表单添加一个具有 display: none css 样式的输入。然后，如果该字段有值，您就知道提交者是机器人。
2) 在表格上问一个简单的问题：“1 加四等于多少：”
添加：对于方法 2，请准备好回答“5”、“五”、“五”等。
Re: non-captchas:
1) Many times these robots try to provide a value for every input. So add an input to your form which has css styling of display: none. Then, if the field has a value, you know the submittor was a robot.
2) Ask an easy question on your form: "What is 1 plus four: "
Added: For method 2, be prepared for answers of "5", "Five", "five", etc.
一个在对抗垃圾邮件时经常有用的解决方案，被多个博客引擎使用（我在我的博客上使用它，而且还不错），是akismet ：他们为个人使用提供免费服务 - 也有一些商业用途的服务。
我从未直接使用过他们的 API，但是，基本上，我想您向其发送评论，然后您会收到一条是否包含“垃圾邮件”的信息。
A solution that often helps when fighting against spam, that is used by several blogging-engines (I use it on my blog, and it's not bad), is akismet : they provide a free service for personnal use -- and there is some service for commercial use too.
I've never used their API directly, but, basically, I suppose you send it the comment, and you get in return an information saying "spam" or not.
他们可能会向他们监控的邮箱发送测试邮件，以尝试确定您的网站是否可以用作垃圾邮件网关。这是我的建议。
另一种可能性（如前所述）是他们试图通过从服务器发送看似良好的邮件来提高 IP 地址声誉。
就试图阻止他们而言 - 他们的机器人通常非常愚蠢。他们不能正确解析 HTML，当然也不能读取表单或支持 CSS。在 display='none' 元素中添加一个名为“email”的字段。确保合法受访者将该字段留空，并且机器人几乎肯定会填写该字段。将您的真实电子邮件字段重命名为其他名称。
那么，任何在不可填写字段中提交值的表单都肯定是垃圾邮件，可以忽略。
其他选项包括使用 Javascript（机器人通常不会执行）来填充隐藏字段，但这些对合法用户代理提出了更多要求（不过仍然比验证码更好）。
如果您使用的技术不太常见或与许多其他网站使用的技术不太相似，那么机器人将没有解决方法。
They may be sending test messages to mailboxes they monitor to try to determine if your site can be used as a spam gateway. That's my suggestion.
Another possibility (as mentioned already) is that they're trying to improve the IP address reputation by sending apparently-good mails from the server.
As far as trying to block them is concerned - their bots are normally very stupid. They don't parse the HTML properly and they certainly don't read the form or support CSS. Add a field called something like 'email' inside a display='none' element. Ensure that this field is left blank by legitimate respondents, and bots are almost certainly going to fill it in anyway. Rename your real email field to something else.
Then any form submit with a value in the unfillable field is definitely spam and can be ignored.
Other options include using Javascript (which bots generally don't execute) to fill a hidden field, but these place more requirements on legitimate user agents (still better than a captcha though).
Provided the technique you use isn't too common or similar to those used by lots of other sites, the bots will not have a work-around for it.
对于 2019 年及以后登陆这里的任何人，我实际上通过一个简单的测试在我自己的联系表单（除其他外）上准确修复了此类消息：
它将向我发送纯文本电子邮件，因此其中不应该有超链接标记，无论是机器人还是人发送的。
因此，我的表单处理代码仅检查
、[/url]或[/link]并发送用户返回一条礼貌的消息，请用裸露的 URL 替换他们的链接标记。这条规则足以阻止每年 6 起机器人垃圾邮件，这些机器人似乎都是同一个机器人，幸运的是它们已经只使用了裸 URL。
For anyone who lands here in 2019 and beyond, I actually fixed exactly these kinds of messages on one of my own contact forms (among other things) through a simple test:
It's going to send me a plaintext e-mail, so there shouldn't be hyperlink markup in it, regardless of whether it's a bot or a human sending it.
As such, my form-handling code just checks for
</a>,[/url], or[/link]and sends the user back around with a polite message to please replace their link markup with bare URLs.That one rule is enough to stop all but maybe 6 botspam per year, which all seem to be the same bot, which got lucky in already using bare URLs only.