4
Magento 1.9.1 and 1.9.3.7
Porto theme

We have 2 Magento installations each with multiple domains/websites. I have noticed recently in the CUSTOMERS --) MANAGE CUSTOMERS area that there are customers with Russian Email addresses there (they never bought anything just registered).

Why would someone do that and is there any kind of a security risk involved? Shall I delete those accounts?

We have had problems with being blacklisted on different blacklists recently even though we NEVER EVER sent any spam whatsover! Could this be connected?

UPDATE ON October 16th, 2018:

We now have 136 348 new accounts. I have activated the Magento CAPTCHA yesterday for both new accounts and Guest Orders but I don't think that worked as we have 700 new fake accounts today alone (and it's only 13:33 MST). What else do I need to do to stop this? I am so desperate I'm even thinking to temporarily stop sending Emails after customer registers. Please help...

  • did you activate reCaptcha on registration – WISAM HAKIM Apr 28 '18 at 13:55
  • magecomp.com/magento-new-recaptcha.html - Add this plugin which add google captcha on your site. So spammer will not add fake data in your site. – Chirag Rajput Apr 30 '18 at 5:30
  • 1
    this is no any hackers, this is just a bot - he registers an account with advertising information, and an activation letter or a newsletter comes to this email back and can be confusing to the owner. just enable honeypot or captcha. – MagenX Apr 30 '18 at 6:53
6

If your Magento doesn't support CAPTCHA or you don't want to active it, you can modify the validate() function (line 709) /var/www/app/code/core/Mage/Customer/Model/Customer.php to block http string in customer name:

if (preg_match('/http/', $this->getFirstname())) {
    $errors[] = Mage::helper('customer')->__('Password minimal length must be more %s', 32);
}
if (preg_match('/http/', $this->getLastname())) {
    $errors[] = Mage::helper('customer')->__('Password minimal length must be more %s', 32);
}
  • This is not working for an url like google.com. Replace /http.*=/ with /http/ as it is almost impossible people to have "http" in the name. I also added this for last name too. – Fa11enAngel Oct 6 '18 at 14:02
  • @Fa11enAngel We now have 136 348 new accounts. I have activated the Magento CAPTCHA yesterday for both new accounts and Guest Orders but I don't think that worked as we have 700 new fake accounts today alone (and it's only 13:33 MST). What else do I need to do to stop this? I am so desperate I'm even thinking to temporarily stop sending Emails after customer registers. Please help... I will try your solution next... – Allysin Oct 16 '18 at 19:40
  • Captcha is too simple in Magento and can be cracked very simple by tools. Try this. Currently it is working what I've changed the answer to. – Fa11enAngel Oct 16 '18 at 20:23
  • It's probably a good idea to change preg_match('/http/', ... to preg_match('/http/i', ... to make it case insensitive. I've not encountered Russian spam links with upper case characters but it would otherwise be easy for them to bypass this check. – Marco Miltenburg Jan 24 at 9:43
  • @Marco Miltenburg what does preg_match('/http/i', ... do? and How do I change it specifically? Thank you. – Allysin May 7 at 16:55
4

Russian Email addresses (just registered).

We have had problems with being blacklisted on different blacklists recently even though we NEVER EVER sent any spam whatsover! Could this be connected?

Sure all of this is connected, if your website send a 'Welcome message' to new users, plus a 'Thank you for subscribing to our newsletter' to people that did not requested that, they identify your mails as spam, and you get blacklisted.

The worst scenario is when they use fields like firstname or lastname to include their 'propaganda', such as links to websites with fraud messages, identified (automatically) as spam by mailbox services.

Here is an example of what can be sent through the firstname via your shop :

Приветствуем Xxx! Ваш баланс №13567996ஆ 06.09.2018 подлежит упразднению. Укажите признак выплаты тут-

Welcome Xxx! Your balance №13567996ஆ on 06.09.2018 is subject to abolition. Specify the payment indication here- http://one-bad-link-here.gq/123456

If sent to russian people only, they may not understand english and just click on this link !

Same thing in chinese too.

  • for solution, see there : magento.stackexchange.com/a/240716/50635 – DependencyHell Sep 9 '18 at 20:00
  • We now have 136 348 new accounts. I have activated the Magento CAPTCHA yesterday for both new accounts and Guest Orders but I don't think that worked as we have 700 new fake accounts today alone (and it's only 13:33 MST). What else do I need to do to stop this? I am so desperate I'm even thinking to temporarily stop sending Emails after customer registers. Please help... – Allysin Oct 16 '18 at 19:39
  • @Allysin : did you fix this issue? – DependencyHell Nov 1 '18 at 13:50
  • Not yet - I've just tried putting in the Magento 1.9 Captcha but I guess it must be outdated because the problem continued. We ended up temporarily shutting the site down (we had like 150 000 new account registrations). Now it's been down for over a week and we are loosing revenue as well SEO rankings so I will have to do something soon. Someone suggested CAPTCHA from Amasty ($59) but I'm not sure if that will really work? Any other suggestions are greatly appreciated. – Allysin Nov 1 '18 at 17:22
  • I've seen other people complaining that the captcha is not enough for these kind of bot. Did you read the solution #6 I wrote there ? magento.stackexchange.com/questions/233368/… you can do this easily in your database, then try to register like the bot does to ensure it works – DependencyHell Nov 2 '18 at 10:01
1

I think your site is attacked by some hackers, Recently I got news that many sites were attcked by this groups, to prevent this you can enable captcha in registration page.

to enable captcha

Go to System->Configuration->Customers->Customer Configuration->Enable captcha

  • Hacked as in they got inside the Admin panel and had access to all the info in there? Or hacked that they sent spam somehow? I am enabling CAPTCHA now - shall I do it for all 3? (Forgot password, Checkout as Guest, and Register during Checkout)? How do they hack the site? Guess the passowrd? – Allysin Apr 28 '18 at 16:49
  • We had 81 fake accounts created on February 16th alone. They all are from something@yandex.ru (the something part changes) – Allysin Apr 28 '18 at 17:00
  • some of them refernce something like: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> rh.drive.google.com/open?id=1eA6rAsRSPrUk_J5zquu6NKG4Mk1irM8v – Allysin Apr 28 '18 at 17:01
  • or this as the name: "<p>The requested URL /es_combine/subjects.txt was not found on this server.</p> 530.drive.google.com/open?id=1Ky1OOErUWAETGRt4OI7phoVSzqNDwRJ7" – Allysin Apr 28 '18 at 17:03
  • 1
    they create account even enable magento default capcha, not sure how they do that – Suneth Kalhara Feb 18 at 8:31
1

May be that can help … I install free module from mageplaza Google reCaptcha - Invisible CAPTCHA and it seems don't have anymore Russian new account.. It didn't cost me a penny and was easy to install.

0

Magento 1.9.x: We also have the problem with Russian "cheaters" that use our Customer Registration form to send spam-mails to a lot of unknown users. They also pass by our reCaptcha. But I found this solution to help (for now): - Reduce the possible text length for the first name / last name to around 30 letters, as the russian text usually are much longer.

You have to edit your database table "customer_eav_attribute". In record 5 and 7, you can change values for length limitations for first name (5th) and last name (7th). Change the max_text_length with value 255 to 30 or any other number of your choice. With longer values in the text box, the "bot" will only get error messages.

  • Hi, For the solution you mentioned above. What should i do for Magento 2.2.6? the validate_rules is showing as "{"max_text_length":225,"min_text_length":1}", and there is also an "input_filter": "trim". should i remove "trim", and edit the 225 to 25? i tried it yesterday but the russian spam still coming through. – Kris Wen Mar 19 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.