Form Spam (eForm) Honeypot Idea - Feedback Wanted

I'm somewhat fascinated by the Honeypot variations people are using and have an idea about a new version I'm playing with. I would appreciate your feedback as to how effective you think this may be compared to the normal Honeypot.

The "normal" Honeypot is a blank field with a name like First_Name or City to provide an extra lure for the form bot to fill it in. The honeypot field is then hidden from humans typically by CSS using "display: none" or "position: absolute" to place it out of the viewport. Finally we have the the form's input checking reject any form that has a non-empty honeypot field.

This is the technique I'm presently using and a recent form bot or two has discovered the honeypot field and won't fill it in. Interestingly I changed the name of the field and that was enough to stop these bots, at least for now anyway.

I have had success with non-MODx forms using javascript. It totally blows my mind that after years of using javascript those web sites have remained spam-free. Surely some form bots must be JS-savvy by now but if they are they're leaving me alone. So ... I decided to modify my eForm honeypot to utilize javascript.

If you're still reading this, here's the idea: Check the honeypot field for specific content and reject it if the field contains anything different. Use an alluring field name and use CSS display: none to hide it, and also leave it blank. In all ways it should look, to a form bot, like a normal honeypot field. HOWEVER, place javascript on the web page far away from the form (outside <form> ...</form>).

The javscript could look like this:
<script type="text/javascript">
<!-- Enable HPot for Javascript human users
{document.getElementById("Country").value = "Seychelles";}
// -->
</script>

Actually, we could enter into and check for virtually anything in the honeypot field, but I picked the smallest country in Africa just because no one has likely ever heard of it, and I needed to put something there.

That's it for my idea. It seems foolproof to me. Do you like it and if so do you agree that it seems bulletproof? (I realize that users without Javascript enabled won't be able to use my form but I don't care about this very rare minority. If you cared, you could muck up your form by not hiding the honeypot field and instructing the human user to enter "Seychelles" into the field. As for me, I hate this approach almost as much as I hate Captchas.)

Thanks in advance for any opinions .... Sam (Gerber)

At least one spamming engine (XRumer) can handle Javascript. I find denying access to known spammers using blacklists is fairly effective, in two flavours:

- check IP against a maintained blacklist such as Project Honey Pot, and simply don't offer spammers a form to fill in. (Method still available on the good old Wiki)

- when spam does come up, check the IP on Project Honey Pot and if it looks worth the effort, use their link to domaintools.com to follow up on the provider. If it's a large one e.g. some Chinese province, or just a plain nuisance like OVH, work out the CIDR number for the relevant address range and deny access to the IP range via your .htaccess file (e.g. "Deny from 27.148.0.0/14" dishes out "403" notices to 262,144 Chinese IPs that have no legitimate business on a Nottingham driving instructor's site). There's a handy chart at http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing.

But overall, I think there are better things to do with your time than get too involved in trying to devise the ultimate anti-spam scheme. The negative energy it generates outweighs any successes. Beyond keeping the spam down to manageable levels, it's better to focus on ways to improve your site for the benefit of genuine visitors, in my opinion.

:) KP

Quote from: kp52 at Mar 11, 2014, 11:01 AM

But overall, I think there are better things to do with your time than get too involved in trying to devise the ultimate anti-spam scheme. The negative energy it generates outweighs any successes. Beyond keeping the spam down to manageable levels, it's better to focus on ways to improve your site for the benefit of genuine visitors, in my opinion.

KP52, your post suggests a technique that's well beyond most people's reach, except perhaps someone who actually manages the entire server and who controls blacklists, etc.

I don't understand why you would say "I think there are better things to do with your time than get too involved in trying to devise the ultimate anti-spam scheme." I had just explained that my Honeypot was recently defeated by more than one form bot. My client received 54 spams in 2 weeks when the normal is zero.

I am not trying to devise the "ultimate anti-spam scheme", but rather a scheme that will stop these new bots that appeared on the scene. That's a good thing to do with my time.

--- Sam