Constant Low Value Fake Orders From a Bot/Malware Script

Question

As if Black Friday was not stressful enough. Since this morning there have been constant order attempts, some successful, for low value items (£4.95). They try over and over... and over again.

This is what the orders look like:

And this is the payment attempts on each order:

I am manually adding their IPs to our .htaccess file however this bot changes IP as soon as they are blocked. I won't be able to keep up. Some of the IPs I have blocked:

deny from 13.68.180.220
deny from 175.176.90.217
deny from 152.32.112.5
deny from 103.27.230.144
deny from 128.90.79.184
deny from 178.208.176.20

If they keep updating their IP address, I suppose there is just no way to sort this out, they will always have a way around what ever guards I put up?

Many thanks for any help or advice.

Answer 1

What's likely happening is the bot is trying to determine which cards are valid.

Have you looked into Wordfence? I don't expect it will solve your problem but it will likely significantly mitigate it because it has a blacklist.

If you have appropriate access, You should also look at the log files for something common and unique. It might be there is something in the REFERER or browser string which could help for example - particularly as it sounds like a bot. If you have this you can isolate this you may be able to use fail2ban to block the IPs.

If its automated, adding a capcha would likely defeat - or at least frustrate it.

Another possibility related to captcha - can you isolate orders placed by something like shipping address (and maybe disallow shipping to that region?)