Spam - fake customers

Please, give me an advice. How can I get rid of spam that creates fake customers? Every day 20-30 fake customers are created.

Thanks!

This is happening to me also. 3 different sites on 3 different servers. All started happening around the same time. Roughly a week ago. March 23rd ish.

adding reCAPTCHA or non-CAPTCHA can help fix issues with bots... with non-bots or human spammers, a simple regex line can help. Regex can also limit or hinder good account creation too..

The standard create account line for first name on a ZC156a page is

<?php  echo zen_draw_input_field('firstname', '',  zen_set_field_length(TABLE_CUSTOMERS, 'customers_firstname', '40') . '  id="firstname" placeholder="' . ENTRY_FIRST_NAME_TEXT . '"' .  ((int)ENTRY_FIRST_NAME_MIN_LENGTH > 0 ? ' required' : '')); ?>

adding this in red blocks some characters not normal to names and limit the length to 20 characters.

<?php  echo zen_draw_input_field('firstname', '',  zen_set_field_length(TABLE_CUSTOMERS, 'customers_firstname', '40') . '  id="firstname" pattern="^[^±!@£$%^&*_+§¡€#¢§¶•ªº«\\/<>?:;|=.,]{' . ENTRY_FIRST_NAME_MIN_LENGTH . ',20}$" placeholder="' . ENTRY_FIRST_NAME_TEXT . '"' . ((int)ENTRY_FIRST_NAME_MIN_LENGTH > 0 ? ' required' : '')); ?>

This only works on humans, bots well walk right by it...

I would also check the template or mods you may be using that they meet current ZC filters.

davewest:

adding reCAPTCHA or non-CAPTCHA can help fix issues with bots... with non-bots or human spammers, a simple regex line can help. Regex can also limit or hinder good account creation too..

The standard create account line for first name on a ZC156a page is

> 
> adding this in red blocks some characters not normal to names and limit the length to 20 characters.
> ```
<?php  echo zen_draw_input_field('firstname', '',  zen_set_field_length(TABLE_CUSTOMERS, 'customers_firstname', '40') . '  id="firstname" pattern="^[^±!@£$%^&*_+§¡€#¢§¶•ªº«\\/<>?:;|=.,]{' . ENTRY_FIRST_NAME_MIN_LENGTH . ',20}$" placeholder="' . ENTRY_FIRST_NAME_TEXT . '"' . ((int)ENTRY_FIRST_NAME_MIN_LENGTH > 0 ? ' required' : '')); ?>

This only works on humans, bots well walk right by it...

I would also check the template or mods you may be using that they meet current ZC filters.

Hi Dave - I asked the question in another thread but no reply to it - "What harm can be done by these spam created accounts?" (if any, aside from being a nuisance)

cheers, Mike

shags38:

Hi Dave - I asked the question in another thread but no reply to it - "What harm can be done by these spam created accounts?" (if any, aside from being a nuisance)

cheers, Mike

None other then wasting your time and resources... basically your mail server and database. If its IP addresses to countries you don't serve you can do a whois search and get the IP range to block through your cpanel ip blocker. I use geektools dot com Pointing to there entry page so you know who they are... look to the top right for the whois page. Assuming you have a tracking mod installed in ZC or you would have to use your raw access logs from your cpanel for IP's.

The spam I've seen are bots who found you to have open inputs without spam protection or using the default words. If they find an open submit, they will exploit it to the max inputs your system can handle. The default ZC filters well strip out html in basic name input fields, the fact that some fields have URL's in them is interesting, I would check your code to see why.

ma.r.a:

Please, give me an advice. How can I get rid of spam that creates fake customers? Every day 20-30 fake customers are created.

Thanks!

Are they all coming from ip address in Russia?

shags38:

Hi Dave - I asked the question in another thread but no reply to it - "What harm can be done by these spam created accounts?" (if any, aside from being a nuisance)

cheers, Mike

The harm is damage to your reputation. You are not the target of the attack . . . merely the tool. The account creation sends an email to the email address provided containing spam and links to potentially serious malware from your shop, domain and ip address. Potential result is blacklisting of your genuine emails by major email providers like gmail, yahoo, apple, etc.

davewest:

The default ZC filters well strip out html in basic name input fields, the fact that some fields have URL's in them is interesting, I would check your code to see why.

Zen Cart 155e

I'm not so sure about the filters because I'm also getting url's in the name fields.

Using Zen Cart 155e
Our website has been receiving the same fake account creations. I've blocked a range of IP addresses via our cPanel and have removed a number of countries from the database that we don't serve. I've also tried to track down the IP address to find a common denominator and blocked them. Given we are not the only targets or tools suggests bots are being used and for us they all seem to come from Urkraine/Russia. I'm no expert but this has been my observation. If only we could rename 'create_account' on a global scale - assuming these bots are trawling the web for create account files.

I've looked at the common factors in the emails we've received (9 since 28 March) from the fake accounts. In the From section these are:
http://project1226271.tilda.ws
http://project1206632.tilda.ws

Full examples (these are only 2 of the 9):
Dear Mr. Constance has left you 3 personal calls http://www.vejen-jagtforening.dk/index.php/tools/packages/easy_news/rss?redirect_url=http://project1226271.tilda.ws

Dear Mr. Helena wants to see you in 12 hours http://www.theu.ro/click.php?url=http://project1206632.tilda.ws

Zean:

Zen Cart 155e

I'm not so sure about the filters because I'm also getting url's in the name fields.

We're getting the same issue with url's in the name field. I've also looked in the Customer table in our database using PHPMyAdmin. I can see that for all our legit customers the email field is HTML where at the fake accounts are TEXT. Not sure if this is relevant. We are using ZC 155e. I would have automatically assumed that ZC filters would scan the name fields and prevent certain characters from being used.

Can anyone tell me where the line of code is that sends email when an account is created, I can't find it.

Found the email send in modules/create_account. I've disabled that for the moment. New customers will not get a welcome email but that will work for now.

I replied on another thread. I done everything imaginable EXCEPT add another CAPTCHA. I suppose I should do so, but I am not encouraged. Has anyone solved this?

fwood2:

I replied on another thread. I done everything imaginable EXCEPT add another CAPTCHA. I suppose I should do so, but I am not encouraged. Has anyone solved this?

Without a link or text link back to your site and/or a list of mods installed, its a guess as to solving or commenting on your problem. The few hits I've noticed on my own site failed to create accounts!!

Having the same issue currently only on one site running version 1.5.5f.
Can anyone suggest ways of stopping these fake accounts or the bots using the site?
Many thanks

This is happening to us as well. 10-20 fake accounts a day. Quite annoying. Did anyone come up with a fix?

ianhg:

Having the same issue currently only on one site running version 1.5.5f.
Can anyone suggest ways of stopping these fake accounts or the bots using the site?
Many thanks
I have just noticed this in debug log would this help? I have removed the domain and changed the backend directory to admin. PHP version 5.6 Zencart 1.5.5f
[17-Apr-2019 09:24:23 Europe/London] Request URI: /admin/customers.php?page=1,
#1 array_merge() called at [/var/www/vhosts/domain.com/httpdocs/admin/customers.php:1163]

[17-Apr-2019 09:24:23 Europe/London] PHP Warning: array_merge(): Argument #1 is not an array in /var/www/vhosts/domain.com/httpdocs/admin/customers.php on line 1163
[17-Apr-2019 09:24:23 Europe/London] Request URI: /admin/customers.php?page=1,
#1 array_merge() called at [/var/www/vhosts/domain.com/httpdocs/admin/customers.php:1165]

[17-Apr-2019 09:24:23 Europe/London] PHP Warning: array_merge(): Argument #2 is not an array in /var/www/vhosts/domain.com/httpdocs/admin/customers.php on line 1165

rjpguitar:

This is happening to us as well. 10-20 fake accounts a day. Quite annoying. Did anyone come up with a fix?

ianhg:

I have just noticed this in debug log would this help? I have removed the domain and changed the backend directory to admin. PHP version 5.6 Zencart 1.5.5f
[17-Apr-2019 09:24:23 Europe/London] PHP Warning: array_merge(): Argument #2 is not an array in /var/www/vhosts/domain.com/httpdocs/admin/customers.php on line 1165

The basic 155f-156a filters for preventing some fields from interning bad data or setting some limits to amount or lack of data is really good. Adding a eye testing CAPTCHA or Honey pot CAPTCHA works on bots.. Lest Google version 3 is working I think.. 2 has known walk around. Blocking IP's work, blocking bad bots helps, I placed some code above that helps with human bots.

In testing, I'm not getting accounts created with what is reported! I can create standard accounts without what's reported, but that's is not what the spammers are after. After adding non-CAPTCHA, the bots have yet to pick the right number! Which is why I ask for links, mods installed, basically, answers to the posting tips so folks here can better help figure out what to help you with...

@ianhg For logs created from admin, if you was not looking at or managing customers... you may have a problem, see this FAQ. If there created as you delete or edit accounts, then its due to the data in those fields, not the code.

@ianhg For logs created from admin, if you was not looking at or managing customers... you may have a problem, see this FAQ. If there created as you delete or edit accounts, then its due to the data in those fields, not the code.
Thanks Dave, I see yes I had deleted the fake customers. Thanks for the help

Not sure if this helps anyone. Yesterday I enabled the "Send Copy of Create Account Emails To" myself and this morning I had 10 new emails for newly created fake accounts.

Does the info on the bottom of those emails or the IP address being used help anyone in solving this?
Is there a way to shorten the login name to say 12 characters? BTW I am using version 1.5.5f

Here are 2 of them.

Office Use Only:
From: http://xurl.es/6jgww Margaret and Emma are waiting for you
http://clear.es/adredir.asp?url=http://project1281990.tilda.ws
Email: [email protected]
Login Name: http://xurl.es/6jgww Margaret and Emma are waiting fo
Login Email: [email protected]
Telephone: 690260761
IP Address: 162.144.5.173 - 162.144.5.173
Host Address: 162-144-5-173.unifiedlayer.com
Date and Time: Wed Apr 17 2019 5:43:19 CDT

Office Use Only:
From: https://bit.ly/2Fn1h04 Candice wants to chat you in 6 hours
https://www.kurumaru.com/shop/redirect-do/DealershipCD/10546/?url=http://project1281990.tilda.ws
Email: gillymonster################################
Login Name: https://bit.ly/2Fn1h04 Candice wants to chat you in 6 h
Login Email: gillymonster################################
Telephone: 962216147
IP Address: 162.144.5.173 - 162.144.5.173
Host Address: 162-144-5-173.unifiedlayer.com
Date and Time: Wed Apr 17 2019 4:33:42 CDT