Junk Customers

[dtlyme]

Hi - How do I clean up junk customers quickly? Is there someway to block these kinds of junk attempts? Does this mean my site is compromised in anyway?
spam-customers.jpg

[lesliekirk]

Hi - How do I clean up junk customers quickly? Is there someway to block these kinds of junk attempts? Does this mean my site is compromised in anyway?
spam-customers.jpg

I want to tag along here. The store owner has had over 8000 apparent junk accounts created during the month of July (2023). The site is using an "older" version of Shadows which allows customers to create an account with just the First Name, Last Name, Email Address, and Password on the LOGN screen. I'm double-checking with the store owner but I think they may have Cloudflare.

[Bruce - PhosphorMedia]

In Customers, use Advanced Search to search for Orders Greater Than 0.

Select ALL records.

Might want to do a quick review for actual customers who created an account, but then choose delete from the Kabob (more, ellipse rat dropping, etc) menu.

[lesliekirk]

In Customers, use Advanced Search to search for Orders Greater Than 0.

Select ALL records.

Might want to do a quick review for actual customers who created an account, but then choose delete from the Kabob (more, ellipse rat dropping, etc) menu.

I had thought about doing that BUT what if a vast majority of these accounts are legit? What if they created an account with the intent to come back? If those accounts get deleted and the customer comes back to find the account they created to be gone...

The store does use Cloudflare which I had thought would keep the bots away. What about using the Customer Created email? Is it triggered when these "mini-accounts" are created from the LOGN screen? If it does then perhaps if the email bounces, would it come back to the store? If not in place now this could be used in the future. Geez, wouldn't it be great if the bounced email addresses could automatically be removed...

[lesliekirk]

Something else I noticed about these apparent bogus accounts - each has come back and logged back in at least an hour after creating the account.

[Bruce - PhosphorMedia]

unless the site is doing something like making people create an account to view prices, its highly unlikely that people are making an account just for giggles....and that's why i suggested folks stroll though the listings an UNCHECK ones that appear legit. (like maybe they just created a wish list).

[alphabet]

Could it be related to the issue found here?

https://www.miva.com/forums/forum/on...omers-accounts

[lesliekirk]

Could it be related to the issue found here?

https://www.miva.com/forums/forum/on...omers-accounts

I'm not sure. The site uses Cloudflare. The accounts created do not look like gobbledygook on the surface. The obvious ones used domain names I dare not google to verify. They all appear to have come from the shortened Create Account on the LOGN page. A good portion of these accounts have been logged into about an hour after creation but no orders placed.

I know that many of the shopping sites I create accounts with now have some sort of two-factor authentication that requires I either confirm my email address or enter a code that was emailed/texted to me.

Is there not a way to do this with Miva Customers? Then if the account isn't verified within X number of days it gets automatically deleted.

[Rick Wilson]

I would recommend the new reCaptcha V3 module to help mitigate this, different path to solving the problem.

[lesliekirk]

I would recommend the new reCaptcha V3 module to help mitigate this, different path to solving the problem.

I had thought about it but a large number of these accounts that are created come back and log in one time. Usually within an hour of creating the account. Perhaps reCaptcha will slow that down but I still think it would be good to also be able to have some sort of verification of the email addresses being used.

[mvasquez]

We've had this issue but only really on one of our 8 sites. We have done different configurations of recaptcha and using v3 finally seemed to end it. We didn't try the module yet, we did it by code.

[Kent Multer]

Nowadays, as I'm sure we all know, it's common for Web sites to send a verification email, with a link that the user must click in order to complete the account-creation process. Is something like that available for Merchant? ... If not, who wants a module for that? You can email or PM me. (Pardon the shameless self-promotion.)

[lesliekirk]

Nowadays, as I'm sure we all know, it's common for Web sites to send a verification email, with a link that the user must click in order to complete the account-creation process. Is something like that available for Merchant? ... If not, who wants a module for that? You can email or PM me. (Pardon the shameless self-promotion.)

Thank you Kent Multer - lets hope we get enough support so you can create a module.

In the meantime, I have installed the new module and I'm not sure if I have it set up correctly. I guess I'm looking to add a token to the template code so that some sort of challenge pops up. Yes, I did assign it to the pages I want it to challenge (within the module configuration).


I keep telling you, you've got to "Leslie proof" this stuff. FYI - I was looking for a slider not a slide button. Sometimes words don't always have the same meaning - this is where an image comes in handy (and not just for me).

[Rick Wilson]

The v3 Module does not require any template changes. Make sure you follow the instructions, I'd set the "rule" to 0.0 for now and go do a test and then make sure it all works.

[lesliekirk]

The v3 Module does not require any template changes. Make sure you follow the instructions, I'd set the "rule" to 0.0 for now and go do a test and then make sure it all works.

I did and done. I understood almost every except it would have been nice to have an explanation of what you won't see on the screens it has been assigned to. Just a nice little point of clarification.