Rails/Devise - preventing spam signups?

user_1121826 0
Viewed 273

We have been noticing a large number (~3400) of fake signups over the last year and have not been able to determine where they are coming from. Common parameters:

  • They often come from weird, yet validly formatted, email address (many in the .ru TLD or from thefmail.com)
  • Some use cyrillic or arabic characters in their name (we are basically focused only on US English speakers by our content)
  • They do NOT trigger the Intercom.io javascript for account signup notifications
  • They somehow defeat reCaptcha 3
  • They sometimes use URLs for their username
  • They don't confirm (devise_confirmable)

We've been handling these by disabling the accounts, and there's obviously a few items above we could use to identify these before they even get created, but I was wondering if someone's cracked this nut already or if there's some simple best practices (pwned db check?) that might cut this down to a dull roar or out entirely.

The two big "I don't get its" are bypassing the JS and defeating recaptcha. Is this just mechanical-turking?

devise spam-prevention ruby-on-rails
1 Answers

Do you know whether these users have been created by the same IP address? (probably not). Are the accounts sporadically created or are they created in batches? The gem rack-attack could be used to mitigate this issue, especially if at least one of these conditions is satisfied. It also comes with some sort of fail2ban filter which could be helpful, as it is designed to detect suspicious requests from 'misbehaving' clients. I also can't understand how they possibly bypassed recaptcha.

user_79738440
Related