Bot's getting through even after blocking the domain

[jengcalendly]

We have blocked a domain via a javascript that is still getting into our Marketo database. 

We cannot replicate the behavior because each and every time we have tried to submit the same form using any email address that they submitted we receive an error that we cannot submit with this domain.

So behavior is:

Form submits are getting through to the database in Marketo and they are a combination of numbers @qq.com 
QQ.com has been blocked via javascript and attempts on our part to submit the form using one of the email addresses that made it through are blocked.

Help please + thank you!

[Darshil_Shah1]

Are you able to provide the JS (or better a webpage with the JS and form on it) so that we can have a look? Also, if you're using the formsubmit API anywhere, it might be the case that the form was submitted by an API call instead of the real form submission on the webpage (probably a long shot, but thought of checking it once).

[jengcalendly]

Sure the form is here: https://calendly.com/resources/ebooks/how-to-guide-teams

Code basically is :

// prevents form submission and displays error if email uses free domain
form.onValidate(() => {
   const email = form.vals().Email;
   if (email) {
      if (!isValidEmail(email, allowFreeEmailDomains)) {
         form.submitable(false);
         const emailElement = form.getFormElem().find('#Email');
         form.showErrorMessage(allowFreeEmailDomains ? 'Domain not allowed' : 'Must be a business email', emailElement);
      } else {
         form.submitable(true);
      }
   }
});

const bannedDomains = ['qq.com'];
const isValidEmail = (email: string, allowFreeEmailDomains: boolean) => {
   if (!allowFreeEmailDomains && freeEmailDomains.some(domain => email.includes(`@${domain}`))) {
      return false;
   }
   if (bannedDomains.some(domain => email.includes(`@${domain}`))) {
      return false;
   }
   return true;
};

[jengcalendly]

@Darshil_Shah1 ^^

[SanfordWhiteman]

1. That’s not valid browser JS.  Looks like TypeScript, which will not execute.

2. A well-written bot doesn’t care about executing your JS anyway.

[jengcalendly]

@SanfordWhiteman 

2. Care to expand?

[SanfordWhiteman]

---

2. Care to expand?

---

A modern-day bot is a headless browser. So it can pick and choose which JS to execute and which to skip. It just needs to send data that the back end will understand. In this case, it’s quite trivial (again, if you’re malicious) to write a bot that submits to the regular ol’ forms endpoint with a bunch of fields and the easily computed hash value, and never touch the email validation step.

[jengcalendly]

@SanfordWhiteman thank you. 

I don't suppose there are ways to stop them?

[SanfordWhiteman · Accepted solution]

---

I don't suppose there are ways to stop them?

---

You want a combo of

• reCAPTCHA (to stop machine-submitted forms from being accepted)
  
• JS and/or native HTML validation (to stop non-malicious and/or non-skilled humans from submitting unwanted domains)
  
• server-side validation (to stop malicious humans from submitting unwanted domains, having skipped around client validation)

However, gaps will always remain.

For example, server-side email validation detects email addresses that cannot receive mail, period. It can also detect well-known domains that give out disposable addresses. But it can’t detect domains that aren’t known for providing disposable emails — even if everything sent to those domains is deleted immediately.