Aloha wrote about price — a contact-form bot farm, measured
A Gotify notification landed on a phone: title Aloha wrote about price, body an address and one line of Belarusian — Прывітанне, я хацеў даведацца Ваш прайс. (Hello, I would like to find out your price.) No company, no scope, no target. On a security consultancy's contact form that reads like a lead. It is not one.
The interesting part is not the message. It is how much infrastructure sits behind one 20-word contact form submission, and how little of it our own site was recording.
One address, measured
The address is [email protected]. Two free reputation sources answer immediately, and both are blunt.
Stop Forum Spam returns frequency: 215, confidence: 97.95, lastseen: 2026-11-09 20:36 for the address — 215 reports filed by other site operators, the most recent of them at 20:36 yesterday. Its country feed tells the operational story better: one page of the Romania feed (2,001 rows) contains 13 submissions from that same address in six days, each under a different display name — Robertmug, Robertquoto, RobertEndus, RobertQuorn, Robertbak, RobertDem, Robertsuect, Robertjesse, RobertPok, RobertPinny — from two IP addresses. The same mailbox also appears in the Germany feed as RobertRar, Robertinold, RobertLaw, RobertFaime and RobertSnone. Robert plus a random word, per submission. Nobody named Robert has 15 middle names.
CleanTalk, which counts differently and more loudly, has the address on its weekly top-20 spam sender list for 2–9 November 2026 at rank 6 with 9,639 websites attacked, first seen 28 October 2026. Its record for that address is explicit: 9,639 websites attacked, discovered Oct 28, 2026, last activity Nov 10, 2026. One mailbox, roughly 800 new sites a day, thirteen days old.
| Entity | Source | Reports | Notes |
|---|---|---|---|
| [email protected] | CleanTalk weekly top-20, 2–9 Nov | 9,639 | rank 6; discovered 28 Oct 2026 |
| 77.90.185.5 | CleanTalk weekly top-20, 2–9 Nov | 11,733 | rank 7 (IP list) |
| 80.94.95.173 | CleanTalk blacklist record | 7,159 | also flagged brute force |
| [email protected] | Stop Forum Spam API | 215 | confidence 97.95 |
| 77.90.185.5 | Stop Forum Spam API | 1,757 | confidence 99.74 |
| 80.94.95.173 / 80.94.95.202 | Stop Forum Spam API | 790 / 759 | confidence 99.4 |
Read the two sources side by side rather than averaging them: CleanTalk sees this traffic on the ~40,000–60,000 entities it hears about daily through its plugin fleet, Stop Forum Spam only what its contributors report. Both agree on identity, both agree it is current, and the smaller number — 215 — is the number of operators who bothered to file it.
Where the traffic comes from
Every submission we can trace to this campaign leaves from one of two small ranges:
- 80.94.95.0/24 — RIPE netname
UNMANAGED-LTD, registered GB, announced as AS204428 (SS-Net, BG), abuse contact[email protected]. CleanTalk groups it under the wider80.94.80.0/20and tags the address as spam on websites, spam by email, other online attacks and brute force — the same box that fills your form also guesses passwords somewhere else. - 77.90.185.0/24 — AS213790 Limited Network LTD, again GB-registered, abuse contact
btcloud.ro. Network spam rate 3%.
A /24 with 3% of addresses spamming at any moment, GB paperwork, Romanian upstream abuse contacts, Bulgarian announcement: that is the standard shape of cheap unmanaged VPS stock. Two ranges, a handful of hosts, and the entire world's contact forms. Nothing here is sophisticated; the economics are simply that a few euros of VPS time buys ten thousand submissions a week.
The kit, not the person
Once you know the shape, you see it everywhere, because plenty of sites publish their contact-form submissions verbatim.
On an Indian academic-publications site, an auto-published notification page from July 2025 records the whole submission: From: LeeAcige, Subject: Aloha i am write about your price, Contact No.: 84583265791, E-mail: [email protected], message body — the same Belarusian sentence, character for character, four months before ours and 6,000 kilometres away. A search snapshot of a Vietnamese beauty salon's customer page dated 06/11/2025 carried the identical line with the number 89232638898; that page 404s today, as did a Racine, Wisconsin barbershop post found in the same index yesterday — these traces have a half-life. A dental clinic runs an intake dashboard that is, right now, reachable without authentication, and its recent inquiries are mostly bot noise: an entry named MEKYUJTYJ436891MARTHHDF, a message that is nothing but Don't miss out on this amazing deal. Get yours now, and, in the copy the search engines picked up this week, RobertNum at our own address.
The clearest view of the machinery is a small Dutch port CRM whose contact list is public. Its spam rows have a fixed shape: a name in <Firstname>tesGM or <Name>pluttKZ form, the organisation field filled with the single word google, a role picked from the site's own dropdown, an 11-digit number beginning with 8 — the Russian mobile numbering plan — and one message from a small template pool: Hallo, write about your price for reseller; Hi, wrote about prices; Hi, i am wrote about your prices; Aloha, i writing about the price for reseller; Aloha i am writing about the prices. Two of the mailboxes in that one table are on CleanTalk's weekly top-20 as well. Our Gotify title, Aloha wrote about price, is the same template line, lightly varied.
That is the fingerprint to look for, and it is not the text. Text varies by design; provenance does not — one mailbox, rotating display names, a company field of google, a phone number that is not a landline in the customer's country, and a request for a price with no stated subject.
What it is for (and what it is not)
The message asks for a price without saying for what. It is compatible with any business on earth, which is the point: it is a probe, not an inquiry. Nobody outside the operation can say for certain what a reply is worth, but the shape of the payload argues for one reading: a reply proves three things worth money to someone — the form is live and unprotected, the notification path reaches a human, and a human answers. That is a validated contact channel, and validated channels are sold. The phone number in the payload invites the reverse: call or WhatsApp the listed number and a reseller pitch follows. Some of these submissions also land on sites that publish them, producing an indexed page at no cost — incidental SEO rather than the objective, since the messages carry no link.
What it is not: phishing for credentials, malware delivery, or a competitor scouting us. There is nothing in the payload to analyse. Treating it as a threat to be understood is a category error; it is noise to be filtered, at the only place filtering is cheap — before it becomes a notification.
What this exposed on our own site
Being honest about the embarrassing part. The homepage contact form is a SvelteKit action that takes email, subject, message and fires one unauthenticated fetch() to a push endpoint. There is no CAPTCHA, no honeypot, no rate limit, no reputation check — and, more damning, no persistence. The only record a submission ever got was a phone notification. So we cannot chart how many of these arrived last month, because nothing was written down, and the operator with 9,639 sites to hit that week was charged 20 seconds of our attention with a mechanism that has no memory and no queue.
That is a common shape for small sites: the form is a pipe to a human, so abuse is measured in annoyance rather than rows. It also means every mitigation that assumes a database — deduplication, scoring, digests, retroactive bans — has to be added before it can be used.
Changes, roughly in order of value per hour spent:
- Persist first, notify second. Write every submission to the same
inquiriescollection the buy page already uses, and turn the one-push-per-message habit into a digest, so a flood costs one notification rather than N. - A cheap reputation check at submit time — Stop Forum Spam's API answers on email, IP and username without a key for single lookups, and its
confidencefield is directly usable as a threshold. Fail open on timeout, so a dead upstream cannot take the form down. - Turnstile plus a WAF rate limit on the action path and
/api/inquiry. The site already terminates at Cloudflare, so this is configuration, not development. - A time-to-submit trap and a honeypot. A bot that posts four fields in 300 milliseconds did not read the labels. Invisible to real users, and no third party involved.
- Alert routing by evidence, not sentiment. Real inquiries get pushed instantly; scored-as-probable-junk gets a daily summary and a review page, because the failure mode of aggressive filtering is a lost customer, and that is worse than a noisy phone.
If your contact form also pipes straight to a notification channel, check what your last five submissions look like in the sources above. curl -s 'https://www.stopforumspam.com/[email protected]&f=json' takes one second and tells you whether the address you are replying to has 215 unhappy colleagues.
Sources. Stop Forum Spam API — address · country feed · CleanTalk — address record · CleanTalk weekly top-20, 2–9 Nov 2026 · CleanTalk — 80.94.95.173 · CleanTalk — 77.90.185.5 · RIPE whois for 80.94.95.0/24 and 77.90.185.0/24 · submission traces seen live: SAAR Publications, Haven CRM contact list, Nebel Dental Clinic dashboard · search-index snapshots, since removed: Hymi Beauty customer page (06/11/2025), elbuenracine.com post (27/03/2026).