Protection of the online store from bots and fake orders

Cybersecurity & Data Protection — incorrectly specified categories?

224 USD

Project translated automatically. Log in or register, to view the original

Online store on OpenCart 3. An automated attack is underway: bots are placing fake orders with random data (names, phone numbers, addresses). They operate in a real browser, bypass Cloudflare and CAPTCHA, constantly changing IPs of Ukrainian mobile operators, with a pool of about 2000 IPs.

The difficulty is that blocking by IP is not possible, as real clients are using the same addresses.

It is necessary to filter out bots without affecting live customers (real orders ~10-20/day, an error in blocking a client is critical).

It is also necessary to protect advertising using our API key to block impressions from particularly aggressive IPs. Blocking at the account level.

What I expect in the response:

How would you approach the task? What detection methods do you see as effective in this case?

Do you have experience with similar (anti-fraud, anti-bot, form protection)?

Estimation of timelines and costs.

Stack: OpenCart, PHP 7.3. Ready to discuss.

The budget is arbitrary; I have no idea of the real cost.

Proposals 12 Discussions

Bohdan Melnyk

3 0

Budget: 10000 UAH Deadline: 7 days

Good day! I have created an anti-bot for the order forms, and your case is classic — mobile operators place subscribers under CGNAT, so you will never distinguish bots from real clients by IP.

I wouldn't block at all. An order is always created, but it receives a suspicion score, and suspicious ones go into moderation instead of being rejected — this way, the detection error doesn't lose anyone, and that's your main risk. Scores are accumulated based on behavior at checkout: a real person moves the mouse and types with pauses, while a bot fills out the form instantly or without any input events at all. The second strong signal is the browser fingerprint, because when the same signature comes from two hundred addresses, it stands out. The third is the fictitiousness of the phone and address; randomness is immediately visible there.

For advertising, I will add the most aggressive IPs to the exclusion list via API. I will take it from your budget, one week of work.

Is your checkout a stock OpenCart or a one-step module?

Dmytro Stasiuk

0 0

Projects -
Rating -
Rating 290

Budget: 10000 UAH Deadline: 5 days

Hello.
The described case cannot be resolved by simply blocking IPs or adding another CAPTCHA: with a real browser, mobile IPs, and passing Cloudflare, behavioral and server-side anti-fraud logic is required.
For the specified budget, I propose the first stage: a technical audit of the order processing flow, analysis of available signals, identification of integration points in OpenCart 3/PHP 7.3, and implementation of basic protection with logging and minimal risk of blocking real customers.
I will check not only IPs but also speed/sequencing of actions, repeated field patterns, sessions, fingerprint signals, checkout anomalies, and rules for suspicious orders. After the audit, I will provide a plan for the next stage with a separate estimate if deeper integration or an external anti-fraud service is needed.
I do not promise "100% blocking" in the bid — the correct criterion here is to significantly reduce fake orders without impacting the conversion of real customers.
I am ready to start with brief access to logs, OpenCart, and the current checkout.

Ihor Doronin

9 0

Budget: 10000 UAH Deadline: 1 day

Good day!

I have reviewed your task. I understand the scope of work and possible options for its implementation.

I would be happy to discuss the project details and propose an optimal solution.

Oleksandr Lyubomsky

0 0

Projects -
Rating -
Rating 164

Budget: 10000 UAH Deadline: 2 days

I will reduce the flow of fake orders without harshly blocking mobile IPs and with controlled risk for real buyers. First, I will analyze the logs and the sequence of checkout requests, highlighting stable signals based on session, device, action speed, and data repeatability. Then, I will add server-side risk scoring for OpenCart: passing low-risk orders, soft checks, or quarantine for suspicious orders, a log of reasons, and customizable thresholds. I will separately configure the transmission of only confirmed aggressive IPs to the advertising API with TTL and rollback capability. A working MVP, test mode, and instructions will be ready in 2 days, costing 10,000 UAH. Is there currently access to the Cloudflare logs and raw data of the latest fake orders?

Serhii Motchany

149 4

Budget: 10000 UAH Deadline: 1 day

Good day.
There is a list of recommendations that have repeatedly saved my clients' websites from spam.
If you have any questions, you can write to me in private messages.

Andrii H.

0 0

Projects -
Rating -
Rating 229

Budget: 17000 UAH Deadline: 7 days

I will set up FastAPI middleware (Docker) in front of OpenCart: JS challenge (PoW + Canvas/WebGL fingerprint + mouse/touch dynamics) at checkout → scoring Isolation Forest based on behavioral traits → session ban of the bot without IP binding. Blocking in Ads API — only based on stable fingerprints/behavior, excluding IP pools of mobile operators. Integration via OCMod/Event, compatible with PHP 7.3.

Experience: anti-fraud for high load with ML bot detector in the browser and synchronization of risk lists in Google/Meta Ads API by devices, not by IP.

Question: which checkout events (add_payment_method, confirm_order) are you currently logging for model training?

Dmytro Parkhomenko

20 0

Budget: 10000 UAH Deadline: 1 day

Good day, I am ready to complete your task quickly and efficiently. I have extensive experience in creating various bots. Please write to me in private messages to discuss the details. I would be happy to help :)