I have a contact form on my site that any swinging spammer can use at will. It has a captcha to avoid automated spam. Due to the client's requirements I can't disable the contact form.

I am using joomla 2.5 and RSFirewall! 1.4.0 Rev 46 and on Thursday, 03 January 2013 I blacklisted an IP address block for contact form SPAM [ 64.85.73.0-64.85.73.127 ].

Yesterday I received spam from an IP within that block [ 64.85.73.28 ]. Under Country blocking I previously blocked "anonymous proxy" not that it has anything to do with a VPS spammer. Just an FYI.

My question is how can someone on the blacklist still send me spam though the contact form?

Hello,

Please note that the GeoIP file used by the Country blocking feature is not a complete file(it does not contain the full range of IPs from all the countries). This file is updated every month in order to include additional information to the country blocking functionality.

Also blocking an entire country in order to restrict a single spammer is not a viable solution. It would be best to try to integrate a reCAPTCHA field in your form.

thanks for the response.

I know the geoIP file isn't perfect and I don't rely on it for one spammer. I probably should never have made a comment about the geoIP file since it's not part of my question.


As I stated in my post I blacklisted an entire IP address block, but the spammer returned anyhow using an IP within that block. How is this possible?

Yes, how is that possible ?