3 ms·
We had the same issue for our $3 price point plan. We never used CAPTCHAS. We fingerprinted browsers, used proxy detection, and other methods to detect them.
by adrr 5y ago
We had the same issue for our $3 price point plan. We never used CAPTCHAS. We fingerprinted browsers, used proxy detection, and other methods to detect them. They would script the page, so we would move live url to a new one and then feed bad data on old page which polluted their data set. It was quite fun messing with them. Most of the bot nets would get caught on browser fingerprinting and that they were falsifying their user agent. Our browse fingerprint ban would say their IP was banned so we would watch them jump from bot net computer to not bot net computer.
- dylan604 5y ago> It was quite fun messing with them. While I can appreciate that, how much time did this take, of how many people, for how long? I ask all of that as someone about to launch a public facing retail site, and absolutely dread this type of stuff. It's a side hustle project on top of my actual day job/contract jobs, AKA I don't have a lot of time to dedicate to this.
- adrr 5y agoNot much time. Probably a couple days. We used maxmind proxy detection and FingerPrint.js. We also used source of traffic. Bots never come in on ads. They come in direct. Stuff we built at a neoBank to prevent credential stuff from password leaks was a lot more sophisticated. Couldn’t trust email based 2fa because people re-used passwords. We did invasive hashing of internal networks with webRTC and also pierced proxies with STUN. Along with using a commercial waf that did real time profiling.