4

I've recently started getting dozens of customer registrations with China spam terms (invocing, payment) and numbers in the customer name. Our site is in English only and does not ship outside the US. None of these customers put anything in their cart.

I already have honeypot implemented from a module, but it's a popular module, so I'm going to customize it.

What are these bots trying to accomplish and should I be worried?

Improve this question

2 Answers 2

Reset to default
4

I sometimes see these customer registrations but monitor and delete them when they appear. Normally a good Bot Protection will stop automated account creation. You could also enable CAPTCHA.

If you are not selling to China and it is becoming an issue then block, at server level, all Chinese ip addresses.

Why not limit access to your website to the US only?
See https://stackoverflow.com/questions/7059619/htaccess-deny-all-by-ip-address-except-those-in-united-states

Improve this answer
4
  • While I agree this can be done, it will disable access for US customers from abroad, I'm not sure you would want that. For example, what if a business person would like to order something to his US home address from abroad?
    – Niels
    Commented Aug 9, 2017 at 9:12
  • If you want security you have to make sacrifices. If you have a country that is trying to exploit your network then is it not better to patch the hole? You could assess each country and ask the question - how many of my customers place orders and ship to the US? If it's not many then you need to protect the masses.
    – hejhog
    Commented Aug 9, 2017 at 13:34
  • We've seen something similar on our website, we just require email confirmation now, it seems these accounts also subscribe to our newsletter, i'm unsure of what the goal they bot is trying to accomplish is, maybe it's just filling out random forms with garbage data to try and get their SEO spam names everywhere in our website or admin panel? The only way i could see this benefiting them is if your site had a ticker that showed the newest user, similar to how some forums do, though i do agree, captcha would be the next logicial step
    – Zachary Craig
    Commented Aug 10, 2017 at 14:02
  • I have also watched one of these logged in accounts start adding queries to the end URLs. Spoke to my web host and between us we could not see what they were trying to achieve. To add an extra layer of security, we limited access to the admin folders (backend and skin) to a dedicated ip address and I did notice a significant drop in the amount of false accounts.
    – hejhog
    Commented Aug 10, 2017 at 14:14
0

Could be caught easily as fake registrations use vast amount of extra POST vars.

// Extra Magento POST variables
if ( false !== strpos( $request_path, '/customer/account/createpost' )
    && ( isset( $_POST['birthyear'] ) ||  isset( $_POST['sYear'] ) || isset( $_POST['year'] ) )
) {
    return 'bad_request_post_magento_vars';
}

I've patched my WordPress WAF just before // @is_wplogin

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.