Our organization is having problems with hackers/spammers. In order for them to enter our webpage, we require the user to enter an email address and we send them a verification code to that email address. At first, they would use a temporary email address (like @sharklasers) to get the code but we've since blocked those domains. Now we are noticing a lot of nonsensical @hotmail, @outlook addresses like email@example.com.
Any ideas as to how are the spammers are doing this? Do they actually have 1000's of legitimate hotmail/outlook/other email addresses that they have access to to get the verification code? Or do you think there is another way they are getting around this? The verification code is a 5 character mix of numbers and letter and we've put in limits as to how may incorrect tries they get to enter the code in so I don't "think" they are brute-forcing that part.
Any ideas or suggestions would be greatly appreciated. Thanks!
******* Additional information to respond to some of the comments/answers *******
I am assuming they are able to get the verification code email and entering in the code correctly because we have logic that restricts the number of chances they get to enter the code. I won't rule out that there could be a flaw in our verification code process but, as it stands, I can't figure out how they can get in without the verification code so I am assuming they are actually receiving emails at these addresses.
We did implement reCAPTCHA BEFORE we had the validation code email but the spammers were seemingly able to get around that. So to reduce UX friction, we got rid of the reCAPTCHA and added the verification email instead. Thinking about it now, though, we did find a problem with our process after implementing the validation code so maybe we should re-visit adding reCAPTCHA back in.
I'm considering them nonsensical because there are hundreds of these email addresses, all with either an outlook.com or hotmail.com domain a day. Typically, we should only get maybe 30 or 40 logins in total a day. They look like they exist just to get around our "no duplicate email addresses" validation. Additional examples: