0

I run a website that allows people to create accounts with an email address address and a password. Over the last month, I have had about 100 accounts created with email addresses that look like this:

pa.rk.i.n.g.x.pe.rtdon.ma.na.h.a.n.@gmail.com (always with lots of dots)

and the provided name is one of

Robertskala
Jeanniebiz
JamesClurn

Usually, the emails bounce and the accounts get deactivated, but sometimes they don't.

Is my website being used for some kind of scam? I don't see any benefit they can get from having an account on my website even if it isn't their email address.

Wondering if I should add a captcha for account creation to prevent some kind of scam or fraud.

UPDATE:

It is so easy to create throw away email accounts and people can already do this to create an account on my website. I don't want to go into the details of my website, but there is no benefit to be gained with a throwaway account there.

Is there a security risk that is related to these long email addresses with lots of dots? I'm wondering if I should reject emails with more than 3 dots.

I googled the email address and there is a Don Monahan who owns a website called parking-xpert. I wonder if a scammy SEO provider is trying to get backlinks for a client through my website?

Improve this question
4
  • 3
    Without knowing anything about your service, it's difficult to know what benefit there might be to someone to try to sign up for it.
    – schroeder ♦
    Sep 30, 2020 at 16:20
  • 3
    Note that gmail strips all dots out of email addresses automatically. If you are username@gmail.com, any variant (user.name, u.ser.n.ame, etc. etc.) will get delivered to you.
    – gowenfawr
    Sep 30, 2020 at 17:07
  • 2
    "... there is no benefit to be gained with a throwaway account there ..." - this is a view only from your perspective and it is assuming that the user is using your site in the way you've intended. Which the user obviously does not, because likely you did not intend somebody to create a user and then don't use the site. The fact that you send out verification emails to arbitrary email addresses might for example be used to annoy specific users with unexpected and strange mails. And there might be other features of your site which can be misused.
    – Steffen Ullrich
    Sep 30, 2020 at 17:35
  • I have seen ecommerce sites made unavailable to legitimate users because of account-creation spam. Even a campaign that was metered enough to avoid that issue would have caused problems for legitimate account creation (e.g. no more available values for primary keys) or caused the database to hit the disk space limits.
    – jiheison
    Jun 4, 2021 at 19:12

1 Answer 1

Reset to default
1

After a little asking around, I've come up with a plausible explanation.

People who are hacking an important account of someone (e.g., a bank account) don't want the person to see security related emails (e.g., new login from an unexpected location) because it increases their odds of successfully hacking the account.

They hide the security email by flooding the person's inbox with random emails. To do this, they create scripts for random websites that send emails to new users. They can make this even more effective with gmails by creating multiple new accounts on a website with different dots since all those email variations go to the same inbox.

So there is no security risk for my own website. I'm just inadvertently assisting a hacker. Fortunately, it is easy to recognize these account creation attempts and block them.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .