PHP E-Mail address harvesting?

[irbk]

I have a form on my website for contacting my company. Users have to put in the standard First and last name, e-mail address and a message. This information is then submitted to a php mail function.
I did this under the impression that the e-mail address the form information was sent to is not really visable, thus crawlers and such could not harvest it for spam.
The user who recieves the e-mail is complaining of spam "from the website". As I said, my impression was that spammers could not get the address, so I'm unconvinced that the user's spam has anything to do with the website.
My question is this, is it possible that the e-mail address could be harvested even though the actual e-mail the form is sent to ony exists within a

<?php mail($recipient, $subject, $body ?>

format?

Thanks in advance!

 

[sleipnir214]

No, the spammer didn't get the email that way.

To whom does the script send its emails?

If it can send to anyone who enters an email address, it may be possible that someone is spamming through your site. It could also be that the computer of someone who once received an email from your site got infected with an email-harvesting worm and sent your site's address on to the spammer, who is now forging emails under your site's name.

Have the person examine the SMPT headers of the message he received. You'll want to look at all the "Received from" headings to see a possible chain of transfers. Keeping in mind, of course, that all but the last "Received from" header could be forged.



Want the best answers? Ask the best questions! TANSTAAFL!

 

[irbk]

The script sends the e-mail form information to a single address that's hard coded in the PHP script.

 

[sleipnir214]

How easy-to-guess is the address from which these emails arrive? Perhaps someone just lucked into the address.


I recommend you get your complaining user to send you the SMTP headers of the message he received. That's the only way to know what's going on.



Want the best answers? Ask the best questions! TANSTAAFL!

 

[irbk]

I'll check the headers and see. To be honest with you, I'm not even sure what "address" that the form mail would be coming from.

 

[sleipnir214]

What's the address of the mail server your script uses?



Want the best answers? Ask the best questions! TANSTAAFL!