How to detect form spamming on your web servers?

Question

If you run hundred of web sites on your servers, what it is the most efficient, automated way to detect if bots are using your HTML forms to send spam email, even if your forms have some kind of protection?

Answer 1

You should be able to see the rates at which particular accounts are sending e-mail on the server, and that's a good first step in detection once a spam run has started. For prevention (an ounce of which is usually worth a pound or so of cure) I like to use the resources of Project Honeypot, which has a great spambot detection system running to detect and list the IP addresses that abuse forms. Participation in the project yourself is a good idea, too.

Answer 2

We don't have it deployed over entire servers, but within specific applications we log any use of forms on the web site. If the application sees several requests coming from the same IP address within a very short time period, we either automatically enable a CAPTCHA on the form as additional protection, or just redirect the form input to a holding area until someone has time to review the contents. After some time passes with no requests, the protections drop back down to normal. I don't suppose this would be too difficult to abstract and deploy over all the contact forms on a server if they are using the same technology platform.

Answer 3

Would Akismet be appropriate for your needs?

From their FAQ:

Can Akismet be used for other things besides WordPress?

Absolutely. The Akismet API can be adapted for almost any application with submitted content, including forums, wikis, and contact forms.