Spam - fake customers

[fwood2]

I replied on another thread. I done everything imaginable EXCEPT add another CAPTCHA. I suppose I should do so, but I am not encouraged. Has anyone solved this?

[davewest]

I replied on another thread. I done everything imaginable EXCEPT add another CAPTCHA. I suppose I should do so, but I am not encouraged. Has anyone solved this?

Without a link or text link back to your site and/or a list of mods installed, its a guess as to solving or commenting on your problem. The few hits I've noticed on my own site failed to create accounts!!

[ianhg]

Having the same issue currently only on one site running version 1.5.5f.
Can anyone suggest ways of stopping these fake accounts or the bots using the site?
Many thanks

[rjpguitar]

This is happening to us as well. 10-20 fake accounts a day. Quite annoying. Did anyone come up with a fix?

[ianhg]

Having the same issue currently only on one site running version 1.5.5f.
Can anyone suggest ways of stopping these fake accounts or the bots using the site?
Many thanks

I have just noticed this in debug log would this help? I have removed the domain and changed the backend directory to admin. PHP version 5.6 Zencart 1.5.5f
[17-Apr-2019 09:24:23 Europe/London] Request URI: /admin/customers.php?page=1,
#1 array_merge() called at [/var/www/vhosts/domain.com/httpdocs/admin/customers.php:1163]


[17-Apr-2019 09:24:23 Europe/London] PHP Warning: array_merge(): Argument #1 is not an array in /var/www/vhosts/domain.com/httpdocs/admin/customers.php on line 1163
[17-Apr-2019 09:24:23 Europe/London] Request URI: /admin/customers.php?page=1,
#1 array_merge() called at [/var/www/vhosts/domain.com/httpdocs/admin/customers.php:1165]


[17-Apr-2019 09:24:23 Europe/London] PHP Warning: array_merge(): Argument #2 is not an array in /var/www/vhosts/domain.com/httpdocs/admin/customers.php on line 1165

[davewest]

This is happening to us as well. 10-20 fake accounts a day. Quite annoying. Did anyone come up with a fix?

I have just noticed this in debug log would this help? I have removed the domain and changed the backend directory to admin. PHP version 5.6 Zencart 1.5.5f
[17-Apr-2019 09:24:23 Europe/London] PHP Warning: array_merge(): Argument #2 is not an array in /var/www/vhosts/domain.com/httpdocs/admin/customers.php on line 1165

The basic 155f-156a filters for preventing some fields from interning bad data or setting some limits to amount or lack of data is really good. Adding a eye testing CAPTCHA or Honey pot CAPTCHA works on bots.. Lest Google version 3 is working I think.. 2 has known walk around. Blocking IP's work, blocking bad bots helps, I placed some code above that helps with human bots.

In testing, I'm not getting accounts created with what is reported! I can create standard accounts without what's reported, but that's is not what the spammers are after. After adding non-CAPTCHA, the bots have yet to pick the right number! Which is why I ask for links, mods installed, basically, answers to the posting tips so folks here can better help figure out what to help you with...

@ianhg For logs created from admin, if you was not looking at or managing customers... you may have a problem, see this FAQ. If there created as you delete or edit accounts, then its due to the data in those fields, not the code.

[ianhg]

@ianhg For logs created from admin, if you was not looking at or managing customers... you may have a problem, see this FAQ. If there created as you delete or edit accounts, then its due to the data in those fields, not the code.

Thanks Dave, I see yes I had deleted the fake customers. Thanks for the help

[rjpguitar]

Not sure if this helps anyone. Yesterday I enabled the "Send Copy of Create Account Emails To" myself and this morning I had 10 new emails for newly created fake accounts.

Does the info on the bottom of those emails or the IP address being used help anyone in solving this?
Is there a way to shorten the login name to say 12 characters? BTW I am using version 1.5.5f

Here are 2 of them.

Office Use Only:
From: http://xurl.es/6jgww Margaret and Emma are waiting for you
http://clear.es/adredir.asp?url=http...81990.tilda.ws
Email: [email protected]
Login Name: http://xurl.es/6jgww Margaret and Emma are waiting fo
Login Email: [email protected]
Telephone: 690260761
IP Address: 162.144.5.173 - 162.144.5.173
Host Address: 162-144-5-173.unifiedlayer.com
Date and Time: Wed Apr 17 2019 5:43:19 CDT

Office Use Only:
From: https://bit.ly/2Fn1h04 Candice wants to chat you in 6 hours
https://www.kurumaru.com/shop/redire...81990.tilda.ws
Email: gillymonster################################
Login Name: https://bit.ly/2Fn1h04 Candice wants to chat you in 6 h
Login Email: gillymonster################################
Telephone: 962216147
IP Address: 162.144.5.173 - 162.144.5.173
Host Address: 162-144-5-173.unifiedlayer.com
Date and Time: Wed Apr 17 2019 4:33:42 CDT

[sjdeines]

The basic 155f-156a filters for preventing some fields from interning bad data or setting some limits to amount or lack of data is really good. Adding a eye testing CAPTCHA or Honey pot CAPTCHA works on bots.. Lest Google version 3 is working I think.. 2 has known walk around. Blocking IP's work, blocking bad bots helps, I placed some code above that helps with human bots.

In testing, I'm not getting accounts created with what is reported! I can create standard accounts without what's reported, but that's is not what the spammers are after. After adding non-CAPTCHA, the bots have yet to pick the right number! Which is why I ask for links, mods installed, basically, answers to the posting tips so folks here can better help figure out what to help you with...

@ianhg For logs created from admin, if you was not looking at or managing customers... you may have a problem, see this FAQ. If there created as you delete or edit accounts, then its due to the data in those fields, not the code.

I am running v1.5.5e with the Template 'Westminster New, Version 1.3' and have blacklisted all IP ranges, removed Ukraine from countries under Localization as that's what the bots were using as the country, remarked out the autoresponder 'welcome' email in the code, added a non-working (but visually there CAPTCHA as I'm still trying to figure out how to add a CAPTCHA to Westminster New. BTW - The IP stored in the created account is actually different than the IP being used as the account is being created. I know this for a fact, as I have logged and even blacklisted the IP being that's viewable in the 'Who's Online' admin tool. In other words, these things are not only spamming from false servers, but are also ghosting IP addresses. SO! If you know how to install a CAPTCHA in Westminster New, that's about all that I've left to try that might work.

[davewest]

I am running v1.5.5e with the Template 'Westminster New, Version 1.3' and have blacklisted all IP ranges, removed Ukraine from countries under Localization as that's what the bots were using as the country, remarked out the autoresponder 'welcome' email in the code, added a non-working (but visually there CAPTCHA as I'm still trying to figure out how to add a CAPTCHA to Westminster New. BTW - The IP stored in the created account is actually different than the IP being used as the account is being created. I know this for a fact, as I have logged and even blacklisted the IP being that's viewable in the 'Who's Online' admin tool. In other words, these things are not only spamming from false servers, but are also ghosting IP addresses. SO! If you know how to install a CAPTCHA in Westminster New, that's about all that I've left to try that might work.

I disable countries I don't sell to. Yes, spoofing IP is normal, they some times forget the host line
1) Westminster new does not modify the customer account page so dropping the tpl_modules_create_account.php file from Google reCAPTCHA should do the job unless its modified by something else. Check there support page if not working.
2) Trace IP's host by the raw server access logs not zen whos online page..
3) check template folder //includes/modules/YOUR_TEMPLATE/create_account.php and delete it if no other mods modified it.. then check the same file in //includes/modules/create_account.php and replace with a new one from a clean zc155e..

If after doing the above, and you still getting hit, follow this FAQ.