Why are spammers creating new accounts on my SaaS every other day?
Why are spammers creating new accounts on my SaaS every other day?
About two months ago, I started getting a slow trickle of new accounts being created with Gmail, Yahoo, Mail.ru, and other similar mail providers. Currently, it's about one signup per one or two days.
The signup form is simply email and password. One email to verify the email address automatically goes out. They are not finishing the verification step. They don't have access to the tool, therefore.
What game are the spammers playing with this activity?
@hostedmetrics Bots like that always fill ALL the fields, you just need to add a "fake" field to you form (hidden with CSS), if the field is filled, then it's a bot. You can also find lists of spam domain to block account creation https://github.com/tsirolnik/spam-domains-list/blob/master/spamdomains.txt or use ip blacklisting with something like https://botscout.com/
Double that. Having the same issue on one of my sites. What's the use of signing up several times and not verifying...
@hostedmetrics One way to stop them is by using Google's v3 (invisible) recaptcha. Shouldn't break the user experience.
I've used it on the PropertyPost.lk contact us page (which attracted loads of spam), and it drastically brought down the number of spam submissions to 0.
Some signup forms are not using password. Remember they use a script, so it requires a pattern. Try a 2 step form. That will stop them. 1) First name and email. 2) e-mail and password....I don't like CAPTCHA. Another option is WAF. https://www.stackpath.com/products/waf/
Not reasonable. Having multiple steps breaks password manager apps.
Spammers are constantly filling out forms because they know they are tied to a email notification or they could possibly get a free/easy link back to their website. Captcha is a pain, look into honey pots. They can be hidden to the user but they only block traffic for a small period in time or with how easily you can spin up a headless version of chrome, I'm finding even the honeypots are seldomly working.
You could also use a service like cloudflare that ties all it's websites together to block spammers across all the websites.
It's possible they don't know about the verification step, but there's a link to your site on some black hat forum somewhere that's continually driving new traffic to you.
A lot of them have come from one ip address in the Republic of Moldova. A quick search brings up reported spam: https://www.stopforumspam.com/ipcheck/188.138.188.34
You might want to consider adding CAPTCHA; that helped me a lot
see
https://www.google.com/recaptcha/intro/v3.html
I don't want to do that. I don't want to burden my users.
It's best for any company if the cost of bad agents is borne by the company if possible instead of being dumped onto the customers or visitors. As long as I'm not being inadvertently used for bad purposes.
So far I know that they're not trying to validate stolen credit cards because they never get that far within the website (because they don't validate the account).
One email every day or two does not sound like they're trying to overflow these people's inboxes, but maybe in aggregate that is what they are up to if they have many websites to behave as senders. Also, none of these emails seem to belong to real people because they never bring up a completed profile when I hover over them in Gmail. They seem to be made up, but they don't bounce either. Maybe these are fake email accounts they're trying to make look human so that they can use them for some purpose down the line?
Version 3 of ReCaptcha is 100% invisible to end user. Google assigns a score on how likely they are legitimate and then you can decide what to do with it.
Aye! @hostedmetrics Go with recaptcha v3.
Interesting! I'll look into it.