[support] Mailform spam from IP blocked in CNC

[Neil Coghlan]

Hi,

I've been pestered by spammers from latvia, Russia, etc for months and 
have another burst in the last 24 hours - about 50 mailform submissions 
from 188.143.232.80. This IP address is blocked using the Apache IP 
Manager in my CNC. Here are the log entries for each submission:

188.143.232.80 - - [22/Apr/2011:03:33:22 -0400] "POST /cgi-sys/mailform 
HTTP/1.1" 302 318 "http://www.esl-lounge.com/premium/guest-survey.php" 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.80 - - [22/Apr/2011:03:33:29 -0400] "GET 
/premium/survey-thanks.php HTTP/1.1" 403 310 
"http://www.esl-lounge.com/premium/guest-survey.php" "Mozilla/4.0 
(compatible; MSIE 6.0; Windows NT 5.1; SV1)"

I presume the 403 code on the second one means the IP manager is doing 
its job, but with the mailform residing above my root, I can't prevent 
the original mailform submissions. Is there anything I can do?

Regards

Neil
esl-lounge.com