1

Does anyone know a way to check if an email address is associated with spam sites? I'm looking to add a check prior to allowing someone to register on my church's website. Apparently my church is a target for bad guys.

Thanks

4
  • 6
    You realize spammers do not use their own email addresses, right? Aug 27, 2009 at 0:42
  • 2
    and that they create dozens of free emails each day.
    – Mohamed
    Aug 27, 2009 at 0:55
  • Are you looking for a blacklist? Aug 27, 2009 at 1:05
  • What can someone do if he/she registers on your website? Think from the perspective of what you are trying to prevent.
    – DmitryK
    Aug 27, 2009 at 1:10

7 Answers 7

7

There is no easy way to check. The best thing you can do is use CAPTCHA to verify that it is a real human registering.

You could also keep your own list of not allowed emails for any users that are abusing your site. You could then ban those emails from being used to register / login on your site.

2

One way is to set your own spam filter. I assume you've received many of them. So, look for common patterns and set the filter rules.

1

The problem is email addresses are easily obtainable -- are you willing to deny access to all gmail, hotmail, yahoo, etc domains (and even if you were, that's not at all a tenable solution)?

If you'll let us know what you are specifically trying to accomplish we can help /w a solution to your problem.

1
  • 3
    -1 This is a non-answer and should be comment. Aug 27, 2009 at 0:44
1

If you intend to send email to the addresses people have signed up with (e.g. church newsletters, etc.), I strongly recommend using a "Confirmed Opt-In"/"Closed Loop Confirmation" approach to prevent malicious users from signing up addresses that don't belong to them.

One way to do it is to send a single confirmation email as part of the signup process, asking them to click a link back to your site to confirm that they wish to receive email from you, and explaining that no further email will be sent if they don't confirm. The link should be difficult to guess, otherwise the bad guys will be able to confirm the signup without ever seeing the confirmation email.

When the link gets visited, you enable the account. If they don't confirm within a reasonable amount of time, silently deactivate the account -- don't pester them with reminders!

1

I found that Akismet is really useful for more then just comment spam. The comment-check method accepts a parameter of comment_type which is documented as:

May be blank, comment, trackback, pingback, or a made up value like "registration".

You'll have to tie this into your code, but it might be worth it.

1
  • commenting down here because thats the only place i have enough rep to, but how did this get kicked off SO? isnt it a question about how to outsmart the spammers and skript kiddies like stackoverflow.com/questions/450835/… is?
    – mwalling
    Aug 27, 2009 at 2:20
0

If you don't like the idea of building your own CAPTCHA, consider outsourcing the authentication using something like OpenID. You can even outsource that to someone else. I use RPX for authentication on my blog, and that allows your visitors to use their pre-existing facebook, twitter, google, yahoo, myspace and openID accounts.

0

Another option to investigate may be Greylisting on your mailserver to assist in mitigating spam.

In a nutshell, the pro is that you will tend to stop a lot of mail from spam applications that do not use a proper mailserver, but you do sacrifice delivery time in doing this.

You must log in to answer this question.