Tons of subscribers to newsletter daily

[addison74]

ORIGINAL POST FROM HERE #1287

This is a known issue in Magento. Please note there is no email subscription input text box as I removed it from the frontend template. However, there are around 50 new subscribers every day. In forums I read there are people with hundreds of subscribers daily.

I managed to collect from the webserver access log all these IP addresses with Fail2Ban filters and I banned them. In one a week there are 3200 IP addresses. Here is the format of the request in access log:

109.1.105.79 - - [26/Oct/2020:10:28:22 +0200] "POST /newsletter/subscriber/new/ HTTP/1.1" 302 577 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36"

Maybe you should fix this issue once and for all in OpenMage that the Magento team didn't want to fix over the years. There are a few extensions out there that are limited to the existence of the input text box and not to such requests made directly from a script.

Blocking these requests is crucial because there is a high chance that an email server such as Yahoo will automatically block an email or IP address for a long time until the human operator can remove it. Although it seems harmless at first glance, in time it can lead to a lack of communication with customers if the store's messages are considered SPAM.

[addison74]

I implemented PR #1866 in production and I use the HoneySpam extension. However, there are bots that bypass the protections. They all have the same trace bellow in the webserver access log. First time the bot gets /customer/account/login/ and based on this reference I guess it gets a formkey that allows it to use the controller.

185.220.101.154 - - [15/Aug/2022:13:16:45 +0300] "GET /customer/account/login/ HTTP/1.1" 200 10272 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:45 +0300] "GET /media/css_secure/9d61060442919f26882d2c6b69233978.css HTTP/1.1" 200 69716 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:46 +0300] "GET /skin/frontend/default/theme2022/js/jquery-1.10.2.min.js HTTP/1.1" 200 93497 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:46 +0300] "GET /skin/frontend/default/theme2022/js/jquery-migrate-1.2.1.min.js HTTP/1.1" 200 7589 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:46 +0300] "GET /skin/frontend/default/theme2022/js/superfish.js HTTP/1.1" 200 4190 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:46 +0300] "GET /skin/frontend/default/theme2022/js/scripts.js HTTP/1.1" 200 16430 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:46 +0300] "GET /media/js/fc56a2bcb4dce9cdef708690a71dba22.js HTTP/1.1" 200 655040 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:47 +0300] "GET /media/css_secure/26670768af273a9ff82cb2fef28f4543.css HTTP/1.1" 200 1154 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:47 +0300] "GET /skin/frontend/default/theme2022/images/logo.gif HTTP/1.1" 200 12113 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:49 +0300] "GET /skin/frontend/default/theme2022/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1" 200 77512 "https://www.mydomain.tld/media/css_secure/9d61060442919f26882d2c6b69233978.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:49 +0300] "GET /skin/frontend/default/theme2022/images/media/bg-login-2.gif HTTP/1.1" 200 11584 "https://www.mydomain.tld/media/css_secure/9d61060442919f26882d2c6b69233978.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:49 +0300] "GET /skin/frontend/default/theme2022/images/block-cart-icon.png HTTP/1.1" 200 2417 "https://www.mydomain.tld/media/css_secure/9d61060442919f26882d2c6b69233978.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:49 +0300] "GET /skin/frontend/default/theme2022/images/media/bg-login.gif HTTP/1.1" 200 10710 "https://www.mydomain.tld/media/css_secure/9d61060442919f26882d2c6b69233978.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:59 +0300] "POST /newsletter/subscriber/new/ HTTP/1.1" 302 594 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:59 +0300] "GET /customer/account/login/ HTTP/1.1" 200 10204 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:59 +0300] "GET /skin/frontend/default/theme2022/images/i_msg-success.gif HTTP/1.1" 200 1383 "https://www.mydomain.tld/media/css_secure/9d61060442919f26882d2c6b69233978.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"

These lines are relevant

185.220.101.154 - - [15/Aug/2022:13:16:45 +0300] "GET /customer/account/login/ HTTP/1.1" 200 10272 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:59 +0300] "POST /newsletter/subscriber/new/ HTTP/1.1" 302 594 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"
185.220.101.154 - - [15/Aug/2022:13:16:59 +0300] "GET /customer/account/login/ HTTP/1.1" 200 10204 "https://www.mydomain.tld/customer/account/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.0 Safari/537.36"

Specifically, it comes to that "customer/account/login" page, fills in and submit the form, page is reloaded and it closes the connection.

[justinbeaty]

Maybe we should consider bringing https://github.com/ProxiBlue/reCaptcha into core? Or as a fork that we install via composer into the release builder.

[addison74]

It would be a bonus for OM to offer a reCaptcha module and replace the old Mage_Captcha, which I think no one uses anymore. I will do some research to find a replacement, we can consider your proposal as a fork.

[fballiano]

we should definetely suggest some recaptcha module, we've our https://openmage.readthedocs.io/en/latest/modules/more.html for that kind of things but actually... I would use composer suggest for that...

[ithuis]

maintained fork https://github.com/empiricompany/reCaptcha

[fballiano]

the one and only @empiricompany! I'll add it to my awesome openmage list!

[empiricompany]

It would be great to have Google reCaptcha under the hood by default, but I'm honest it takes time and resources that I don't have right now. About the extension I use it successfully on all my customers, I had to make some changes to make it compatible with OpenMage.