0

Our organization is having problems with hackers/spammers. In order for them to enter our webpage, we require the user to enter an email address and we send them a verification code to that email address. At first, they would use a temporary email address (like @sharklasers) to get the code but we've since blocked those domains. Now we are noticing a lot of nonsensical @hotmail, @outlook addresses like asdfralkaiow@hotmail.com.

Any ideas as to how are the spammers are doing this? Do they actually have 1000's of legitimate hotmail/outlook/other email addresses that they have access to to get the verification code? Or do you think there is another way they are getting around this? The verification code is a 5 character mix of numbers and letter and we've put in limits as to how may incorrect tries they get to enter the code in so I don't "think" they are brute-forcing that part.

Any ideas or suggestions would be greatly appreciated. Thanks!

EDIT:

******* Additional information to respond to some of the comments/answers *******

I am assuming they are able to get the verification code email and entering in the code correctly because we have logic that restricts the number of chances they get to enter the code. I won't rule out that there could be a flaw in our verification code process but, as it stands, I can't figure out how they can get in without the verification code so I am assuming they are actually receiving emails at these addresses.

We did implement reCAPTCHA BEFORE we had the validation code email but the spammers were seemingly able to get around that. So to reduce UX friction, we got rid of the reCAPTCHA and added the verification email instead. Thinking about it now, though, we did find a problem with our process after implementing the validation code so maybe we should re-visit adding reCAPTCHA back in.

I'm considering them nonsensical because there are hundreds of these email addresses, all with either an outlook.com or hotmail.com domain a day. Typically, we should only get maybe 30 or 40 logins in total a day. They look like they exist just to get around our "no duplicate email addresses" validation. Additional examples:

  • thaytismtvxuy@hotmail.com
  • noutopjrvll@hotmail.com
  • thooshefrmqo@hotmail.com
  • sheyseauthurfkp@hotmail.com
  • tathestdx@outlook.com
  • tandathehfbq@outlook.com
  • souteegwbt@outlook.com
  • tisloushafvi@outlook.com
  • phynyezkxoofv@outlook.com
  • sesoughurqo@outlook.com
4
  • 2
    I'm not sure if I understand everything from your question: are the spammers are actually able to get the verification code sent to these addresses, i.e. do they use the correct verification code on the first try? In this case these are pretty sure valid email accounts they control. – Steffen Ullrich Sep 27 '20 at 20:19
  • 1
    "nonsensical" is a value judgement based on an invalid assumption. Those are legitimate email addresses but with random strings for the account name. "getting around" what exactly? – schroeder Sep 27 '20 at 20:23
  • It sounds like you could use a captcha to prevent bots from registering ... – schroeder Sep 27 '20 at 20:23
  • With your proposed edit, you appear not to have understood my comment. You claim that these are "fake" and "nonsensical". They are either. The samples you provided are real, live, active email addresses. It appears that you didn't even check them. If you had, your question would simply be: "how do I get bots to stop registering with our service?" and all your other questions about "getting around" and "how are they doing this" and "do they have 1000's of fake email addresses" would not need to be asked. – schroeder Sep 28 '20 at 8:34
2

Use CAPTCHA and/or telephone number verification (SMS OTP).

It was perfectly okay to ban known disposable email providers. However, there exist(ed) services that ran on stealthier domains (coming out: I ran one of those).

Free email providers offer email addresses for free, upon simply a registration. They may require a CAPTCHA to prevent automation.

CAPTCHA, which is something you can implement yourself, protects from automated requess, and is decently effective. It blocks automated attacks.

What CAPTCHA does not is to protect from human click farms, where the attacker may hire a large number of poorly paid workers to solve the CAPTCHA, register with a free mail address, and post spam.

By using phone verification, and likely limiting the country of those mobile numbers, you are raising the bar of difficulty to the attacker.

The attacker must get a unique SIM card for every access to your website. Getting a SIM card is not that fast and easy like getting a free email address. Getting a SIM card has a fixed cost (e.g. when I change provider I always pay a non-refundable-in-credit cost around 5€ for the hardware, the card itself) and in many countries it requires proof of ID, which raises a yellow flag in a phone company if someone activates a stock of 1000 SIM cards.

Please note that this won't completely stop spammers, but will slow them down. Probably a lot, so that you will simply notice them no more.

Your mileage may vary

Please remember that antispam techniques are meant to slow down large attackers, not completely stop them

I suggest to take a look at this video that shows what a click farm is. An attacker with enough human resources can still get a decent number of SIM cards, have humans solve CAPTCHAs, register for emails and send spam.

There are similar videos. A click farm is an organization originally made for the purpose of boosting social media scores (likes, follows and engagement).

Beware!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.