Gsyfuy

Magento 1.9.1 and 1.9.3.7

Porto theme

We have 2 Magento installations each with multiple domains/websites. I have noticed recently in the CUSTOMERS --) MANAGE CUSTOMERS area that there are customers with Russian Email addresses there (they never bought anything just registered).

Why would someone do that and is there any kind of a security risk involved? Shall I delete those accounts?

We have had problems with being blacklisted on different blacklists recently even though we NEVER EVER sent any spam whatsover! Could this be connected?

UPDATE ON October 16th, 2018:

We now have 136 348 new accounts. I have activated the Magento CAPTCHA yesterday for both new accounts and Guest Orders but I don't think that worked as we have 700 new fake accounts today alone (and it's only 13:33 MST).
What else do I need to do to stop this? I am so desperate I'm even thinking to temporarily stop sending Emails after customer registers. Please help...

If your Magento doesn't support CAPTCHA or you don't want to active it, you can modify the validate() function (line 709) /var/www/app/code/core/Mage/Customer/Model/Customer.php to block http string in customer name:

if (preg_match('/http/', $this->getFirstname())) {

    $errors[] = Mage::helper('customer')->__('Password minimal length must be more %s', 32);

}

if (preg_match('/http/', $this->getLastname())) {

    $errors[] = Mage::helper('customer')->__('Password minimal length must be more %s', 32);

}

Russian Email addresses (just registered).

We have had problems with being blacklisted on different blacklists recently even though we NEVER EVER sent any spam whatsover! Could this be connected?

Sure all of this is connected, if your website send a 'Welcome message' to new users, plus a 'Thank you for subscribing to our newsletter' to people that did not requested that, they identify your mails as spam, and you get blacklisted.

The worst scenario is when they use fields like firstname or lastname to include their 'propaganda', such as links to websites with fraud messages, identified (automatically) as spam by mailbox services.

Here is an example of what can be sent through the firstname via your shop :

Приветствуем Xxx! Ваш баланс №13567996ஆ 06.09.2018 подлежит упразднению. Укажите признак выплаты тут-

Welcome Xxx! Your balance №13567996ஆ on 06.09.2018 is subject to abolition. Specify the payment indication here- http://one-bad-link-here.gq/123456

If sent to russian people only, they may not understand english and just click on this link !

Same thing in chinese too.

I think your site is attacked by some hackers, Recently I got news that many sites were attcked by this groups, to prevent this you can enable captcha in registration page.

to enable captcha

Go to System->Configuration->Customers->Customer Configuration->Enable captcha

May be that can help … I install free module from mageplaza Google reCaptcha - Invisible CAPTCHA and it seems don't have anymore Russian new account.. It didn't cost me a penny and was easy to install.

Magento 1.9.x:
We also have the problem with Russian "cheaters" that use our Customer Registration form to send spam-mails to a lot of unknown users. They also pass by our reCaptcha. But I found this solution to help (for now):
- Reduce the possible text length for the first name / last name to around 30 letters, as the russian text usually are much longer.

You have to edit your database table "customer_eav_attribute". In record 5 and 7, you can change values for length limitations for first name (5th) and last name (7th). Change the max_text_length with value 255 to 30 or any other number of your choice. With longer values in the text box, the "bot" will only get error messages.