Mail Manager Spam and Hack

Question

Hi all,
This isn't really a DW specific question, but I figured all
the smart folks here will have figured this out already. I’ve
been using the MMEX mail script for many years. I don’t know
a lot about website management, and it works for me, so I’ve
never had a reason to switch.
Recently, using this script, I keep getting fake form
returns, from many different sources, usually drug or sex sales
oriented. Here is the latest one:
Dear Recipient,
This is a notice that a new submission has been generated by
by Mail Manage EX on Jun 27, 2008 @ 5:19:05 pm.
***Form Results***
Skills: britney sex comics spears bikini britney comics
spears bra sex britney comics spears bra sex
Experience: NO EXPERIENCE
Email: [email protected]
Volunteer: SEND INFORMATION...
Firstname: britney comics spears bra sex
Shirt:
http://bezodoka.cn/britney-spears-sex-comics.html
Commitment: SUBCOMMITTEE
Address: [email protected]
Skiability: NONE
Lastname: britney comics spears bra sex
Phone-home:
http://bezodoka.cn/britney-spears-sex-comics.html
City: Moscow
Phone-cell: britney comics spears bra sex
User's Browser:
User's IP Address: 76.200.88.212
- Mail Manage EX Notifier -
I thought I would outsmart them by creating rules (phone
number formatting, etc.) that would stop this, but they keep coming
through, regardless of the formatting rules.
Can anyone tell me how to stop this stuff from happening?
It’s a real pain! What do other folks do to stop this kind of
stuff?
Thanks for any help.
Mark Nadell

Answer 1

The script is using these rules in the form:
# MAIN SETTINGS
$Require = "firstname,lastname,email,phone-home";
$Format =
"lastnameA,email@,phone-home#,phone-work#,phone-cell#";
And this is the code from the mmex file itself concerning
phone formatting:
if ($Format == "#" and $_POST[$Field]) // PHONE NUMBER FORMAT
if (!eregi('([0-9]{3})-([0-9]{3})-([0-9]{4})',
$_POST[$Field]) and !eregi('([0-9]{3})\.([0-9]{3})\.([0-9]{4})',
$_POST[$Field]) and !eregi('([0-9]{3}) ([0-9]{3}) ([0-9]{4})',
$_POST[$Field]) and !eregi('(\([0-9]{3}\))-([0-9]{3})-([0-9]{4})',
$_POST[$Field]) and
!eregi('(\([0-9]{3}\))\.([0-9]{3})\.([0-9]{4})', $_POST[$Field])
and !eregi('(\([0-9]{3}\)) ([0-9]{3}) ([0-9]{4})', $_POST[$Field])
and !eregi('(\([0-9]{3}\)) ([0-9]{3})-([0-9]{4})', $_POST[$Field])
and !eregi('(\([0-9]{3}\)) ([0-9]{3})\.([0-9]{4})',
$_POST[$Field]))
$Field = str_replace("_"," ",$Field);
$Field = ucfirst($Field);
$IncorrectFields .=
"<li><b>$Field</b> requires the proper
phone format.</li>";
if ($Preview == "1")
$RedFields .= "$Field,";
But somehow, the formbots, as you call them, don't seem
affected by that code, as I get information in the phone number
field as web addresses.
Mark