Terminating guest shopping cart du to missuse

I have a guest (Not logged in) that is just loading up products into a shopping cart that seems to be an intentional mis-use of the store. They are just adding products in to get as many products they can in, as well as driving up the total. I have blocked the IP address, but they just come in as another IP address.

Is there a way to stop this bad behavior? There has to be a way to force their temporary shopping cart to be emptied, but I do not know where this is held.

Have you all seen this and what do you recommend to stop or curb this intentional mis-use???

If they're not logged in, their cart is in a temporary variable in server memory, and in a temporary session record in the database, which is automatically purged after a period of inactivity.

Thanks for the quick reply. The only place I see the session is in the sessions table. If I delete a session key, will it terminate the guests cart?

I believe that this is a robot doing this because no one would sit at the computer and place items in a cart all day long. The current cart is up over $12,000, which is not a real shopper.

Couple questions:

1. Is there any other session data in teh database other than the session table?
2. You say that the cart is in memory. Is it in memory in the guests browser, or in memory for the server?

I tried to add in the IP Blocker plugin but it does not show up in the admin tools menu so I am at a loss as to other things I can try to stop or prevent these rogue guests from adding the world to their shopping cart.

OK, more info on this attack. When looking in the Admin -> Tools -> Who's Online, I see 9 different IP Addresses all using the same session key. This is definitely a hack attempt, or at least a attack of some sort. I delete the session key, and it just keeps going with the same session key that I deleted. You can set the who's on-line page to refresh every 5 seconds, and watch the cart contents grow.

It is true that when I deleted the session key, the cart in the Who's On-line view emptied, but then started growing again.

Is there a setting that allows only one IP address per session?

I am at a loss here, but this is a problem that ALL zencart users will see unless there is a miss-configuration in my store.

Thoughts???

This adding of product to a cart has no impact on product availability on a standard ZC as first to check out "wins". If it/they are just adding product then it will have no effect on the availability of other guests to purchase the product.

In regards to the two questions recently posted, sessions themselves are stored in the sessions table of ZC and the data associated with that session is stored in the memory of your host's computer.

The effect of the action is 1) increased loading on the server and 2) gathering of whatever information that is being sought. At the moment also the time being taken to address this is having an effect on your ability to work on other things.

The fact that the IP blocker install did not go as expected is more than likely a result of an incorrect installation as the plugin has been maintained.

As to some sort of setting for one ip per session, no. Basically two visitors should not share a session because upon arrival to the site each customer is provided a different zenID; however, as I have come to understand it, if the zenID is shared in a link regardless of what that zenID is then everyone that uses that zenID will share the same session data. Thus if two+ people navigate the site at the same time, when one adds a product to the cart, the other will see that their cart has that item when the cart data is updated for display. Therefore it is advised that the zenID never be a part of a posted uri.

One thing that can be useful is the plugin that allows blocking by User-Agent
Its intent is to block 'Bad Bots', you must be extremely careful when you use it to block other User-Agents

Does the "Bot" that you are observing use a uniquely identifiable User-Agent?
Using the wrong string can cause legitimate users to be blocked.

https://www.zen-cart.com/downloads.php?do=file&id=1854