Website hit with auto user registration

whosvato

Registered Member
Joined
Oct 22, 2022
Messages
83
Reaction score
47
Hello,
Not so concerned about this, but would like a few solutions to prevent it from happening.

As of today, recently checked my website and seen 2500+ user registrations same day. All users have unconfirmed email and registered with email such as;

[email protected]
[email protected]
[email protected]
[email protected]

etc.
Captcha is on for registrations, registrations are still going, at least one or two new accounts per minute.

Can anyone explain the purpose of someone mass spaming bot registrations or how to prevent it from happening?

Thank you!
 
I don't know the purpose of creating mass accounts on your website but to stop that from happening, you can try the following:

- Require users to verify their email address or phone number before they can create an account. This will make it harder for them to use fake emails to create accounts on your website.

- If they use the same IP address, try to find a way to block those IPs from accessing your website.

If these 2 don't work, you might need to look for a more advanced captcha system.
 
you can enable email confirmations. the attacker will update his bot to connect to imap...regex the confirm link...and confirm it.
why is he doing it? why does cat chase a rat. is there anything to gain from being a registered user on your website? post comments, upload content, connect with other users?
because if there's no financial benefit from it, eg making bulk accounts to PM other users an affiliate link, they are doing it just because they can do it.
common tactic is whitelist @yahoo @gmail @hotmail @outlook @aol and ban all others.
 
Thank you for all the answers from everyone, working on implementing a solution.
Had an idea to switch Google reCAPTCHA to GeeTest, but GeeTest is quite pricey but it works like a charm.

Website is a classified ads directory for adult companions to post advertisements.

Account only becomes valid once email is confirmed, until that a user cannot post any advertisements.
 
have you checked if they are all the same IPs? if so, ban it
get a bot catcher or change your registration to another url and not the default wp one
have something like Akismet
 
Update;

Updated the Google captcha to their most recent version that they have, the mass registrations spam went away.

Thank you for everyone who provided me with their advice, much love
 
Back
Top