I have a small business that provides an online service, like a CRM service for businesses.

Over the last few weeks, I've had 20 - 30 random accounts created. (this is unusual as I might get one or 2 a month).

They would create an account, then add a few random clients and do a few other bits. I will then disable the account to stop it logging in.

I added a recaptcha to the site for signing up, but still, the accounts get created every day.

I'm logging the IP address when the account is created and the IP source is from two different countries (does not change that often, but always the same state).

Any ideas about what's going on? How I should handle this situation?

  • 4
    Difficult to say without seeing logs and such, but they're likely probing your service for vulnerabilities that can be exploited. They'll create an account because being logged in provides them access to a larger attack surface, and they'll poke around to see if they can find any vulnerabilities they can exploit. – DKNUCKLES Jan 5 '18 at 15:08
  • 1
    Are they not supposed to be able to create accounts? I'm not clear on what the problem is. – schroeder Jan 5 '18 at 15:32
  • 1
    why are you tagging this question ddos? – schroeder Jan 5 '18 at 15:34
  • Are you sure they are hacker accounts? I remember many years ago a colleague called me that "someone is using the system", which was just shipped a day ago. I made them log out, then we found out that the client was demoing it inside the company :) So those might be potential clients checking out the product as well. But if you use some broadly used frameworks (like WordPress), that can automatically attract hackers or scripts. BTW you could force the users to enter phone number, and you could try to contact them on phone. – Crouching Kitten Jan 5 '18 at 16:44

Well, remote diagnostics with a big portion of assumption on how your infrastructure looks like, would not produce results you can rely on, so I am writing in a more general-approach:

I would suggest, that you do some kind of investigation first to better understand the motive of the potential hacker. Did you for example check about the IP reputation of the IP source, i.e. with OTX (https://otx.alienvault.com/)?

Another option could be to put an IDS and WAF in front of your Online Service, as that would help to gain more insights. If that is too complex, the most simple way would be to at least record the packets to replay them / analyze them with i.e. Wireshark.

In terms of IDS / WAF, you could consider the following technology as they are not only industry standard, but also Open Source:




Last but not least it is always a good idea to pentest your setup to have a better understanding about the potential risks there. OWASP Zed Attack Proxy is a good start:


|improve this answer|||||
  • 1
    Nothing in the question hints that there is a weakness, vulnerability, or that there is a technical problem that a WAF, IDS, or a pen test might solve – schroeder Jan 5 '18 at 15:30
  • If you read between the lines, there could be a weakness, vulnerability, or technical problem. Here it's necessary to prove a false positive then.The tools are the same. – Gambaz Jan 5 '18 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.