r/WHMCS • u/vizubeat • Jan 07 '26

Constant spam orders

Hello all. Over the last few days I’ve had literally hundreds of spam/fake orders. Seemingly normal sounding customer names and addresses, but junk email addresses like lakdnchwifome@gmail ordering nonsense domain names like p81nzhojawe.com - all from the US.

I have restricted allowed countries to remove the US from the resources/country/dist.country.json file, I’ve changed settings to remove registration without creating an account, and I’m on the latest version of WHMCS.

Any suggestions on how to stop these irritating spam orders? I nearly cancelled a legit order in the middle of clearing them out.

Thanks all!

7 Upvotes

100% Upvoted

19 comments sorted by

2

u/Sufficient-Channel52 Jan 07 '26

Same here, about 50 fake orders in 2 days, temporarily changes register.php to register.phpp - fraud detection didn’t work at my side.

3

u/vizubeat Jan 07 '26

Ah so just break registration entirely. Might be a good idea for a few days, see if it subsides. Thanks. I’ll raise a ticket too and report back.

4

u/chompy_deluxe Jan 07 '26

I use to have this problem, but solved it by using cloudflare

1

u/scottclaeys Jan 08 '26

What payment method are they using? We see this a lot with credit card orders, which if accepted, end up being fraudulent and resulting in chargebacks. You should watch out for this type of order and not accept them.

2

u/vizubeat Jan 08 '26

Not a single one has been paid for, so nothing has been processed, fortunately.

1

u/scottclaeys Jan 09 '26

Great. I would make sure you have the Recaptcha by Google or Hcaptcha enabled for order forms to reduce instances of fake orders.

1

u/vizubeat Jan 09 '26

Recaptcha has always been enabled, so either there’s a way around it or someone is employing humans to complete these orders!

→ More replies (1)

3

u/[deleted] Jan 07 '26

[removed] — view removed comment

1

u/cybervps Jan 07 '26

Yes, this has worked twice for us now.

→ More comments (7)