is this an attempt of code injection or just spamming?

Question

Hello, community! Once in a while we get registrations on our website similar to this one. (This is a transcript of an email notification):

New User Registration
FirstName: cowdqd
LastName: cowdqd
Company: nWJrFxUitwFMbnK
Email: [email protected]
Phone: oCFsfSHolrnx
Fax: -152
AddressLineOne: xRQgqnCOJkkoA
AddressLineTwo: obsDvktXDL
City: vqxXGZQgIplDwm
Province: AB
PostalCode: kgyabr
Country: CA
IncludedInPromotions: Yes
RequestInfo: No
Comments: x0EDw7 eecfocnmvwzu, [url=http://fvbppxzancnj.com/]fvbppxzancnj[/url], [link=http://tyflcliodtqa.com/]tyflcliodtqa[/link], http://ldklshrkpwwn.com/
RegistrationDate: February 24 2010

I thought it was spamming, but usually the emails and links are not even valid. Why would anybody want to do that?

Answer 1

Sql injection tries don't look like that ;). This is just spam :). Sql-injection looks more like this:

' OR 't'='t';


http://stackoverflow.com/questions/2327413/is-this-an-attempt-of-code-injection-or-just-spamming/2327430#2327430'OR1=1

Answer 2

Why indeed...

It's not an injection attempt, it looks like a bot is trying to submit spam comments to blogs and has mistaken your registration form for a comment form. Annoying, but not an attack.

Answer 3

You can normally tell SQL injection attempts as they look like snippets of code to some degree. This is bizarre in that unless they own those extremely bizarre domain names, there is no real benefit.

It could be someone just trialing / testing your form by typing with their Elbow... :P

Answer 4

This could be spam, or it could be someone doing a sort of "perimeter test" on your system to see if you use a captcha, if you validate certain types of data, if the data is posted somewhere public, etc.

For instance, the string "eecfocnmvwzu" looks random, but it might be specifically generated to be unique. An attacker can then do a search of your website looking for that string and, if it's found, they might know that they can script a form submission and have the results show up. Once they know that they might submit a new form that looks more legit but contains an attack of some kind, perhaps a XSS attack or a link to a website that hosts malware.

I don't know if that scenario is realistic, but it seems possible.