CE Phoenix Cart Forum

I've been using @burt's Maths Captcha for account registration for a while, but the fake accounts have worsened recently. Is it all possible that humans created those counterfeit accounts?

Thanks in advance for your input.

Eddy

Moxamint wrote: ↑Sat Jul 29, 2023 11:18 am Is it all possible that humans created those counterfeit accounts?

Yes. That seems to be one of the solutions to captchas. Just use humans who can pass them. Really cheap humans. We get a few accounts registered to the forums each week. That's why first time posters have to be approved to post, so spammers don't get any search engine benefit from posting.

It's also possible that ChatGPT is capable of passing them. I haven't tried.

ecartz wrote: ↑Sat Jul 29, 2023 3:01 pm

Moxamint wrote: ↑Sat Jul 29, 2023 11:18 am Is it all possible that humans created those counterfeit accounts?

Yes. That seems to be one of the solutions to captchas. Just use humans who can pass them. Really cheap humans. We get a few accounts registered to the forums each week. That's why first time posters have to be approved to post, so spammers don't get any search engine benefit from posting.

It's also possible that ChatGPT is capable of passing them. I haven't tried.

@zipurman helped me spot the bot, the Bytespider, that caused my issues. It might be created by the company that owns TikTok. Anyone who has a similar issue could try blocking it.

Cheers, Eddy

Now the bad bots return... >300 fake accounts a day. Can they fake their IP as well? I saw some repeated IPs that the fake accounts used, but blocking those IPs did nothing.

Eddy

If it's enough of a problem, a solution may be this;

1. create_account as normal
2. immediately log the user off and send them an email asking them to log in.
3. any new account that doesn't log in by (say) 24 hours, auto delete them.

That, of course, may be undesirable depending on how many real accounts you get.

What is the purpose of the fake accounts, I wonder?
Are they making the first name something like http://www.yahoo.com in the hope that you click it?

Maybe these people/bot are auto filling forms? In which case another idea would be to add in a blank input box named something like "phone". As it's hidden it should always be blank when the sign up form is submitted - if not blank, error out - as it would mean a bot has seen the input field and done something.

burt wrote: ↑Tue Aug 15, 2023 3:04 pm Maybe these people/bot are auto filling forms? In which case another idea would be to add in a blank input box named something like "phone". As it's hidden it should always be blank when the sign up form is submitted - if not blank, error out - as it would mean a bot has seen the input field and done something.

In case you wanted to try this idea

app.php/addons/paid_addon/honeypot/

burt wrote: ↑Tue Aug 15, 2023 3:04 pm If it's enough of a problem, a solution may be this;
....
2. immediately log the user off and send them an email asking them to log in.

Thanks, Gary. It IS a royal PITA. It's hundreds of fake accounts each day. My registration form has already had enough for the customers to fill in; I am afraid the extra login procedure will produce too much friction and scare my customers off. They don't always receive emails from me anyway, as their (governmental agencies) servers often apply stringent rules on incoming emails, particularly those that contain external links.

burt wrote: ↑Tue Aug 15, 2023 3:04 pm What is the purpose of the fake accounts, I wonder?
Are they making the first name something like http://www.yahoo.com in the hope that you click it?

Not sure. They do not generate any links to click on. Maybe they were looking for insecure forms to inject malicious code but had never succeeded?

burt wrote: ↑Tue Aug 15, 2023 3:04 pm Maybe these people/bot are auto filling forms? In which case another idea would be to add in a blank input box named something like "phone". As it's hidden it should always be blank when the sign up form is submitted - if not blank, error out - as it would mean a bot has seen the input field and done something.

The forms were definitely auto-filled. I shut down the site for a few hours on the weekend, but the bots came back immediately after the site went back online. I will give this 'blank input box' honeypot a try.

Thanks again, Eddy

Hi @burt Gary,

I am still getting the fake accounts, but the bots seem to have slowed down after applying the honey pot. I'll keep monitoring it.

Thanks, Eddy

If it's helped even a little that's a good thing.
I'm not sure what else to try..

Have you tried recaptcha ?
I think I also did a recpatcha alternative, I'll try to find it.

viewtopic.php?f=28&t=1391

I haven't looked at that since the day I made it, maybe its worth a try ?