Timeline for How do we deter malicious Civi Contribute credit card testing?
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 3, 2022 at 17:36 | comment | added | MattEMBA | I will look into options to rate-limit the frequency which the page can be served all-together. This will need to be purely based on page loads, since we don't want to require login and the attackers rotated IPs. That may prove a little blunt but we don't receive a high frequency of simultaneously donations anyway. Thank you! | |
| Oct 1, 2022 at 17:43 | comment | added | JohnFF | Rate limiting is the key here, as Iowa Boy says. I'm unfamiliar with how to do this on Joomla! forms, but there will be a way and this approach will save you this kind of headache in the future. | |
| Sep 30, 2022 at 23:51 | comment | added | MattEMBA | Good to know! Even if we were Drupal and used the CiviWebform Integration, I suspect that type of user/IP blocking would not have worked in this case, as the page does not require login and the user was rotating IPs with each request. Seems like we need a solution that isn't IP-based. | |
| Sep 30, 2022 at 23:22 | history | answered | Iowa Boy | CC BY-SA 4.0 |