Spammer Hell: Wasting spammer's time
Published: 2023-12-29 15:34:34

---
title: Spammer Hell: Wasting spammer's time
published: true
date: 2023-12-28 18:14:23 UTC
tags: 
canonical_url: 
---

Some time ago, Troy Hunt made [an article](https://www.troyhunt.com/sending-spammers-to-password-purgatory-with-microsoft-power-automate-and-cloudflare-workers-kv/) about a website he made, Password Purgatory. The project worked like this: If you receive a spam or phishing email, you would add a label to your email that would trigger an automation. That automation would reply to your email with something like this:

> Hello and thank you for your email.
> 
> I would like to invite you to leave your information on [link to the website], it will only take a moment.
> 
> Thank you,
> 
> <name>

The website would then ask you to create an "account" by typing an email and a password. When submitting, the spammer would get an error that the password didn't fit the requirements. Kind of like [Neal's Password Game](https://neal.fun/password-game/), but you would never be able to continue.

This would waste the spammer's valuable time, a way of getting revenge. I thought the idea was very cool, so I decided to build my own.

Troy Hunt made an open [Password Purgatory API](https://passwordpurgatory.com/), that I will later use to generate the error messages.

* * *

## Building a copy.

I started by making a simple HTML website that showed you a field for email and another one for a password. Email would be just a disguise (as it would seem like a real login form), and the password would host the impossible challenge.

![First design of the login page](https://cdn.hashnode.com/res/hashnode/image/upload/v1703781392816/f284e12c-3c14-4060-9c1c-85a2ecd30733.png)

Not bad at all!

I also added a loader when the page loads (that'll waste a bit more time) and another one when you click the "Continue". Plus, now when you click the "Continue" button, the password is erased.

Then, I decided to add my spin to it and add a captcha. Captchas waste a lot of time, so I decided to use [this free captcha API](https://rapidapi.com/MenesesGHZ/api/captcha-generator/) I found on Google.

I didn't care at all about the captcha being bypassed using basic JavaScript to read the solution from a variable, so I just made a cute little widget to ask for it. The captcha was generated by sending an API request to the backend which would then return the captcha URL and the solution.

![Login page hosting the captcha](https://cdn.hashnode.com/res/hashnode/image/upload/v1703783775178/4ee8f4e7-d6f3-4228-b98c-f09c838f3908.png)

I made it so the captcha only showed if you had tried more than 5 times, as that would increase the chances of the spammer not realizing they were just wasting time.

I then added name and surname inputs (to collect more info lol) improved the code a lot, and it was ready to ship! I also built a simple admin dashboard with all the info.

![Finished fake login page](https://cdn.hashnode.com/res/hashnode/image/upload/v1703786723178/00e87e8a-d07c-4239-a78b-a2bb88cf14ae.png)

![Finished admin dashboard](https://cdn.hashnode.com/res/hashnode/image/upload/v1703786994598/8d1b1724-381c-4ac5-bfd5-6ac904176ae2.png)

Nice! Now I can send the link to any scammer who emails me and waste their time :)

You can check the code for yourself and remix it (make your own server hosting the software) at [https://glitch.com/edit/#!/contact-tr11](https://glitch.com/edit/#!/contact-tr11?path=README.md%3A21%3A37)