2

I am getting massive amounts of fake newsletter subscriptions - mostly a randomly generated Yahoo email address. I've looked through the logs and there are 50+ IP addresses, seems like it's from a botnet. Anyway, does anyone have any ideas how I could stop this? Should it be done on a server level or at a codebase level?

4

I know two options you have:

  1. Add a fake field, with a cool name, like name or url, make it invisible with JS or CSS (something the bot can't interpret), then the bot fill this field but a human does not and then check whether the field is filed, if it is, it is a bot.

    For your luck, we already did something like this, but I just saw, newsletter registration is missing. But you can only register for newsletter (in core magento) if you are registered. So I can only inspire you: https://github.com/magento-hackathon/HoneySpam/

  2. The second thing you can do (but there is NO REASON IN THE WORLD TO DO SO(!!)) is using a captcha. Bad idea, bad technique, bad behavier, a lot of problems for your customers willing to register for the newsletter. So this is more a plan Y. Shortly before plan Z disable the form.

  • +1 for the HoneyPot approach. but I really don't like the captcha thing. You should write it in a smaller font so only the desperate people read it. :) – Marius Jan 9 '14 at 7:41
  • 1
    HoneyPots are good, but unfortunately this attack seems to only target the newsletter email input field. – Francis Kim Jan 9 '14 at 9:07
  • Oh, did you try? This is hard. Then you can try with an XSS field, when they only send the newsletter-field, they might forget the XSS field :) – Fabian Blechschmidt Jan 9 '14 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.