No More Form Spam From Tor and Server Farms
Forms, bookings and newsletter sign-ups now refuse posts from Tor, VPNs and hosting networks. Real visitors on a VPN are told what to change.
Last week we started dropping bot spam by what it says. One campaign kept coming: a made-up name, a real-looking email address, every box ticked and an empty message, about once an hour. It passed Altcha, the honeypot and the timing check, because it drives a real browser and is in no hurry.
So we looked at where it came from. Over three days, 121 posts hit one contact form. 94 came through Tor. The other 27 came from rented servers and VPN exits. Not one came from a home or mobile connection.
What changed
Since 27 October, a form submission, a booking or a newsletter sign-up sent from a Tor exit, a VPN or a hosting network is refused. The sender sees a short message saying so and asking them to turn it off and try again. On your form it shows as Spam under Recent Activity, like the other refusals.
The check uses three public lists: the Tor exit list and two maintained lists of datacentre and VPN ranges. We keep a copy of them in a public mirror of our own, refreshed every three hours, and match on our own servers. No visitor’s address leaves them or goes to a third party.
Who this affects
A bot running on a rented server, which is nearly all of them. Also a real person browsing through a VPN or Tor, who is told why and can switch it off for a minute. We think that trade is right: in the sample above, that person did not exist.
Pages, scripts and calendar feeds are untouched. Only the three posts are checked.
What to do
Nothing. It is on for every form, booking page and list, on every plan. If an enquiry you were expecting has gone missing, or junk still gets through, email us at and we’ll look at it with you.
Update, 28 October. Apple’s iCloud Private Relay sends Safari traffic out through ranges that sit on the VPN list, and a Relay user has no idea they are on a VPN. Those ranges are now carved out. Apple publishes them and our mirror holds a copy, so a post from one is never refused.
The first day’s numbers, from the same contact form: 18 posts since the block went on, all refused, 15 of them over Tor. Not one post in 48 hours came from a home connection or a Private Relay range. The bot still arrives about once an hour and now gets a plain no.
From here, the mirror carries two lists of our own beside the three we copy: a block list for senders the public lists miss, and an allow list for anything that turns out to be a false positive. Both are public, so you can see what is on them.
Ready to Deploy?
Join Jamstack developers across the UK hosting their static sites with privacy and performance built in. Hosting is free for good, no credit card needed, with Plus features when you want them.
