advice needed on website spam protection

Hi All,

Not sure if this is the right place but if not admin can you please move the post to the correct location.

For the past year or so i always got fake customer accounts being created on my website but i always blocked the IP's manually as soon as i saw them coming in fast and deleted the accounts. They just don't give up they go quiet for 2 weeks or so and come back again, today i got google reCAPTCHA setup on registration page and contact is page but they still managing to create the accounts. Not sure what else i can do so any advice would be appreciated, i also think my customers will hate the reCAPTCHA but will see within the next 48 hours how many missed orders i get.




Thanks
Abz

it's an infinite battle but you can eventually win it if you fight long enough.
add recaptcha = attacker will set up captcha solving service
limit registrations to 1 per IP = attacker will set up a proxy server
only allow yahoo/gmail/aol/hotmail and blacklist all other emails. and make them verify email. this will cut down on a lot of people using spam/fake emails which looks like you have plenty of. don't forget to add something to stop people doing the user+[email protected] trick eg not allowing "+" or two "." in the email. again this cuts some attackers down, but a dedicated attacker will just buy 1000 hotmail accounts with smtp access so he can click that verification link.
depending on your site, you can restrict user actions for 7 days. eg you cannot PM for 7 days. this will discourage attackers but harm real users too.
recaptcha is also commonly supported on captcha solver sites. try finding some lesser known but still secure captcha alternative.

lots of other ways hopefully others will chime in. tactics i mentioned will discourage some attackers. harder you make it for them=more they have to work. from their POV, they have to be making more $ than time investment of jumping through your hoops.

reflect on what exactly these fake users are doing once they are registered. and how can you throw a wrench into that. maybe they are signing up to send bulk PM to other users. limit the amount of msgs a user can send. [now they are force to make more accounts to bypass limit]. maybe they are sending a specific msg == censor their message phrases.

alterative you can start researching other commercial solutions. im not affiliated but i just googled your problem out of curiosity and there's services like https://www.ipqualityscore.com/

They can't really do anything with the website as its a clothing site and after registering you don't get much options apart from see orders you have placed on that account.

i just think they are trying to black list the site with email providers since the more emails the system sends out to example hotmail they will think its spam and black list my emails etc. right now i have turned off the email notification people normally get after signing up so hopefully im not blocked already which would me customers won't get any order confirmation emails or updates unless they log into their accounts to see.

the google reCAPTCHA i setup didn't make any difference as they still registering so many accounts on the site and i'm just added to block ip's list manually which is just annoying

sounds like not doing much damage other than fucking with your metrics
you could always have users give a phone number to verify with to complete signup
or limit signups to 1 per IP per 24-168 hours.

"limit signups to 1 per IP per 24-168 hours" this might be just what i need to do to solve this issue for a time being . thanks

facebook fans said:

They can't really do anything with the website as its a clothing site and after registering you don't get much options apart from see orders you have placed on that account.

i just think they are trying to black list the site with email providers since the more emails the system sends out to example hotmail they will think its spam and black list my emails etc. right now i have turned off the email notification people normally get after signing up so hopefully im not blocked already which would me customers won't get any order confirmation emails or updates unless they log into their accounts to see.

Click to expand...

You should be considering what fake email sign-ups do to your overall email server health when transactional/user reg emails constantly leaving your shared [email protected] ect email that shares with your real customers.

This is a neg mail server attack, and especially if you auto subscribe sign-ups to your email newsletter, they can mass unsubscribe and destroy your email server.

Take this seriously, trust me, comes from experience