Spam Registrations

Question

I've found multiple threads with this issue but no solution yet.

I have a constant stream of user account being created using the domain @qq.com. All different email addresses and just gibberish as their details.

I got the IP from session logs and added the following to .htaccess:

Deny from 172.69.134.186

But the registrations continued.

I tried adding captcha to my registration form but when I do, it fails to show the captcha at all but still looks for it when the form is submitted, this preventing anyone from registering!

Any help would be greatly appreciated. I have tried various solutions and I'm getting thousands of registrations a day! Thank you.

Answer 1

Use Google reCaptcha on your submit form and add server side validation. use below code to validation google reCaptcha on server side.

public function checkCaptcha(array $post)
{
    if ($post['g-recaptcha-response']) {
        $captcha = $post['g-recaptcha-response'];

        $secretKey = Mage::helper('gorilla_recaptcha')->getRecaptchaPrivateKey(); // replace this with private key
        $response = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=" . $secretKey . "&response=" . $captcha);
        $responseKeys = json_decode($response, true);

        if (intval($responseKeys["success"]) !== 1) {
            return "failed";
        } else {
            return "success";
        }
    }
    else {
        return "failed";
    }
}

Answer 2

I had faced the issue of these spam customers on our store too. The store was on magento 1.x . I could not say that a single solution will work 100% as it depends on how the attack has been implemented. Let me share some of my thoughts.

1. Implement google recaptcha

You are going in the right direction of implementing the google recaptcha. This could prevent the case if it is the default vulnerability. I am not sure which version of Magento you are using but here is a quick tutorial of implementing the google recaptcha for magento 1

You can also implement the custom code for recaptcha implementation. Please confirm what you have implemented does the both frontend and server side validation. For me doing the clientside as well as server side validation worked and the spam customer was prevented.

But if you still seeing this issue after implementing the google recaptcha see check point 2.

2. Look for customization and loop holes

Yes if google recaptcha doesn't prevent the issue. There could be a case where any custom extension has the loop hole which may have the code that creates the customer and not well sanitized like form key validation and all. Look for that too.

3. Try implementing honeypot If these customers are created by submitting the customer registration form with auto fill data, you can add a hidden text field, which normal customer won't see, but these scripts will fill it and then you can check on your controller if value presents in that field. If yes, prevent the customer addition else create the customer. This is my version of the implementation. I think there are other better approaches too.

Hope this will help you solve your issue.