garbage new accounts / spam

[jmelson]

Well, the creation of garbage new accounts has gotten really annoying. I'm getting at least 20 a day, now. I believe ONE PERSON is doing all this, as there's a very strong pattern.
Almost all of them have a matching letter jumble for first name and last name, except the last name has 2 capital letters on the end. The street address is the same as the city, and
the phone number always starts with "8". For a while they were mostly coming from a small IP range in Russia, so I blocked that whole /24 range. Now, i'm getting the same garbage from
all over Europe, constantly different IP's, so there's no way to block them. I don't see the point in this.

Second, I get a bunch of spam emails through the store "contact us" link, but those really aren't much of an issue to delete.

I was hoping that osCmax would continue for some time, I'm fairly comfortable with it, and have several customizations installed. But, Authorize.net upped their encryption and doesn't work anymore with osCmax, and I don't know how to fix it.

Thanks for any suggestions,

Jon

[ridexbuilder]

Recaptcha V3.x

Encryption: that's a server config issue.

[jmelson]

Well, yes. They changed the encryption suite such that the payment module no longer works with their system. And, I don't know enough about the php script to make the upgrade.
My guess is it is just a few lines that need to be changed, but I have never found out how to do it, or found a consultant I could afford.

Thanks,

Jon

[ridexbuilder]

You followed the link to help with spamming?

I can take a look at one of my client sites that uses a.net and see which module they are using..

Authorize.net Advanced Integration Method (AIM) Version: 2.1

Orders using the above are as recent as today.

[jmelson]

You followed the link to help with spamming?

I can take a look at one of my client sites that uses a.net and see which module they are using..


Orders using the above are as recent as today.

OK, the difference is I want to use SIM, so I never see the credit card info. That makes my life WAY simpler in regards to PCI compliance.

Thanks,

Jon

[ridexbuilder]

OK, the difference is I want to use SIM, so I never see the credit card info. That makes my life WAY simpler in regards to PCI compliance.

Strangely, I've never been asked to allow a PCI scan on the server that I run for them. :-/
AFAIK, the two modules use the same 128-bit encryption, so perhaps it's purely down to your server environment, as I previously mentioned. Do you run the server/VPS yourself or is your site hosted by a provider? If a provider, then they should be able to offer at least some assistance.
(My hosting/consulting isn't that expensive! )

Did the spamming link help?

[jmelson]

I was with Tsys for merchant account and Authorize.net for payment processor, and at least the predecessor for Tsys charged $199 a year for PCI compliance verification, they ran a monthly script against your server and showered me with complaints about compliance. If I said I never processed card information, then they were a lot less demanding. If I said I did, I was required to run the server on a totally separate network connection, which is hard to do in your house.

Yes, I run the whole server here out of my basement.

I had Authorize.net SIM working here for a number of years until they changed the encryption. I even asked here if several users wanted to get together to hire a consultant to make the changes, but got no interest.

I was not able to find the spamming link either on this thread or the previous one.

Jon

[ridexbuilder]

Yes, I run the whole server here out of my basement.

Hmm, not really a good option for a commercial site and you're bound to attract more scrutiny from 3rd party providers. Reliable VPS hosting really is a cheap commodity these days, especially if self-managed. Managed hosting can be less than $10/month. A dedicated IP, to run a second instance (if required) can be around $2/month, depending on provider.
As a sysadmin, you need to investigate encryption suites for your webserver; this is only a small part of what I do with my value-add hosting.

I was not able to find the spamming link either on this thread or the previous one.

Strange. Look for the relatively recent thread on ReCaptcha - I use a simple alternative that curbs the spammers pretty well. Read through the thread - it's a fairly simple process.