Magento :: solution for customer registration spam

If you noticed that your Magento store every day sends new account spam from registration form and user accounts are created in your store sending spam mails to random email addresses, mostly in qq.com, 168.cn, mail.ru, inbox.ru, list.ru or bk.ru domains, that means your registration form is unprotected from automatic submission. You may receive messages from your Mail Delivery System like this:

Mail delivery failed: returning message to sender

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  [email protected]
    SMTP error from remote mail server after end of data:
    host mx1.qq.com [203.205.219.57]: 550 Ip frequency limited 

Cause

Spam bots search for unprotected forms that allows email submission to any addresses and submit mail from any possible form to spoof server IP-address. Magento registration form is one of such forms by default, so it is a target for such attack.

Solution

Protect your registration form with our implementation:
If you have not yet decided to use our implementation, you can still reject a lot of bots with a default Captcha core module,

Important: Default implementation is often misused and treated ineffective, make sure to implement all instructions correct.

• navigate to System > Configuration > Customer Configuration > CAPTCHA
• switch Enable CAPTCHA on Frontend to Yes
• select Create User form to protect to (and any additional if appropriate)
• Important: set Display mode to Always

If you still see automated submissions coming after that or wish to order us implement solution for you, please order our custom implementation for your store.

If you have any difficulties with solving this problem or got a similar one, please let us know in comments below, so we can find the solution together.

Posted in: Magento Maintenance