Large Carts and Fake Accounts

[bumba000]

Hi All,
So for many years now we'll occasionally get new accounts with first last name combos like SDFUBEugsuGSDGH IEJJFNdhfyrGHFN with a company name of normally either google or microsoft. These are usually tied to an IP address over seas. Aside from this we also have had very large active shopping carts with anywhere from 50 to 100 or more items in the cart.

Lately both of these have ramped up significantly. I'm pretty sure I've taken care of the bogus accounts issue, but I'm wondering what do either of these have to gain by doing what they're doing, and how can we prevent these large carts that have no intention of purchasing?

Thank you,
John

[Shop Suey]

I saw something similar at a customers Shopware 5 store.
After purging the account the bot immidiately created a new account.
Also subscriped to the newsletter in high frequency.

The used mail account was an account which doesn't accept mail e.g. example.com so the mail server always send an error report to the customer who was restricted using his mail system effectively.
I added honey pots to both registration and newsletter subscription to stop these attacks.

[lat9]

My Access Blocker (https://www.zen-cart.com/showthread....Support-Thread), based on the threats identified by https://ipdata.co, can help. That will result in a reduction in (a) contact-us/ask-a-question spam and (b) limit login/create-account actions for any identified threats. You can also add specific IP addresses/ranges and/or countries to its processing.

[swguy]

You can do other things as well:

https://docs.zen-cart.com/user/troub...cking_attacks/

[bumba000]

Hey Lat9. Sounds like a great mod. I used the bot check field in the tpl_modules file and the includes/modules file to actually ask for user input. But adding the question in the field label in text seemed to defeat the purpose. Instead I put the text question in an image and called that in there. So far... zero fake accounts. On the contact pages I added a time on site minimum. less than 20 seconds on the site and it wont send an email. I might check out your mod in the near future.

Thank you,
John

[bumba000]

You can do other things as well:

https://docs.zen-cart.com/user/troub...cking_attacks/

Hey Scott. I have been wanting to auto add ip addresses to the htaccess for years now, but have always been super hesitant about automatically updating it sort of blindly. I saw your idea for adding ips to a table or even a text file and then using a cron to update the htaccess file. Genius! I love the idea and may work it out in the very near future. The only issue I can see is that I sometimes add ips manually and they're not being blocked. I guess the ip is somehow being spoofed. Like they aren't interested in the response from the server... they just want the massive number of requests...?

John