Website attack: What is the attacker's goal?

Question

A bot network(?) has been after my website for quite a while now. Here is a breakdown of what they do:

1. They register several accounts using random characters for building a first and last name which look like this:

   HludvkxTGVIwP oBScrLdvJ
   AicSJbYk uWrVKZtSdTNAv
   ...
   

2. The email addresses used for these profiles seem to be valid email addresses from real people but I can not say whether they are just used by the attacker or if they have actual control over those addresses. What I do know, though: The emails are never confirmed by the link sent to those newly registered accounts.

3. The attacker then goes to the password retrieval page and sends "new password" requests which is weird as I think they don't receive the answer because of the lack of control over the email used in the profiles created …

I would like to understand what the attacker is trying to achieve in order to evaluate if this is a threat. Why would he send password requests for an account just created by themselves a minute ago?

The ip addresses change all the time, so it seems to be a network.

Answer 1

I would like to understand what the attacker is trying to achieve in order to evaluate if this is a threat.

From the points you listed, the symptoms points to DOS attack. Try captcha (only a suggestion: google recaptcha v3) as a means of protection against BOT based resource consumption attacks for web facing tech.

Why would he send password requests for an account just created by themselves a minute ago?

The accounts are all valid and password reset link works as mail bombing attempt. Kindly implement captcha or alternative control to prevent this from occurring.

If the mails are tagged spam instead of receiver hitting unsubscribe due to multiple similar pointless mails, it may hurt your reputation in long term and mails from your domain will soon be blocked my multiple spam filters regularly.

Answer 2

I can think of two things. Both are equally likely in possibility.

The first possibility is the creation of multiple accounts to use on your website. With multiple accounts, if one were to get banned, another one can be used. The only thing needed is for the person who receives the confirmation email to click on the link. You claim that none of the accounts ever get confirmed. Creation of multiple accounts by robots or bots is not a new thing. This is especially seen for email websites. The new accounts can be used to send out spam to email addresses. With multiple bots each creating at least an account, as the IP addresses are different, it can be considered a botnet is interacting with your website.

The interesting point that you said however, is the account creator makes "requests" for password reset. This leads to the second possibility, the password reset mechanism is being used to either spam email addresses or is trying to create a Denial-of-Service attack for those email domains. The DOS is being carried out by the large amounts of password reset emails being sent out. Basically, your server is being used here for carrying out an attack.