How to Stop OTP SMS Abuse When Attackers Rotate Valid Phone Numbers, Emails, and IPs?
Hi friends, I am currently dealing with a problem. An unknown person is targeting the OTP SMS service on our website's sign-up page. They are attempting this using multiple phone numbers, multiple email addresses, and rotating IP addresses. We are already using email validation services, yet they are using email addresses like "bowobon834@sepmaf.com" and "kiyow78785@toooby.com." They are also using a specific series of mobile numbers, such as:
"+201195127174", "+201181110723", "+201195130069",
"+201195127216",
"+201181111455",
"+201195127472",
"+201181113961",
"+201195127038",
"+201195129482",
"+201000177595",
All these numbers are valid. What kind of service provides such valid numbers? By submitting only valid numbers, they are negatively impacting our SMS budget. They are using two types of emails: valid permanent ones (like "mai.t.hi.e.ndi.9.5.5.11@gmail.com", "ph.a.nd.ong.nh.i.19.5.8.5@gmail.com", "m.er.ed.ith.geron.i.mo.24.1@gmail.com") and temporary ones (like "nofon85312@sepmaf.com", "yiridog100@toooby.com", "sapija5854@sepmaf.com").
Both types of emails they are using are valid. There are so many services that provide temporary emails; it is impossible to block them all. We simply won't be able to block every single one.
currently we create a script to mai.t.hi.e.ndi.9.5.5.11@gmail.com that pattern email but. when user email is normal and pass email verification service and able to create account in that case they put mobile number and send otp the promblem is occured the all number is valid in lookup api and they rotate the number, IP to prevent throttling.
What really matters is the service that provides valid phone numbers. If anyone has information about such services, please help us out.
Hi friends, I am currently dealing with a problem. An unknown person is targeting the OTP SMS service on our website's sign-up page. They are attempting this using multiple phone numbers, multiple email addresses, and rotating IP addresses. We are already using email validation services, yet they are using email addresses like "bowobon834@sepmaf.com" and "kiyow78785@toooby.com." They are also using a specific series of mobile numbers, such as:
"+201195127174", "+201181110723", "+201195130069",
"+201195127216",
"+201181111455",
"+201195127472",
"+201181113961",
"+201195127038",
"+201195129482",
"+201000177595",
All these numbers are valid. What kind of service provides such valid numbers? By submitting only valid numbers, they are negatively impacting our SMS budget. They are using two types of emails: valid permanent ones (like "mai.t.hi.e.ndi.9.5.5.11@gmail.com", "ph.a.nd.ong.nh.i.19.5.8.5@gmail.com", "m.er.ed.ith.geron.i.mo.24.1@gmail.com") and temporary ones (like "nofon85312@sepmaf.com", "yiridog100@toooby.com", "sapija5854@sepmaf.com").
Both types of emails they are using are valid. There are so many services that provide temporary emails; it is impossible to block them all. We simply won't be able to block every single one.
currently we create a script to mai.t.hi.e.ndi.9.5.5.11@gmail.com that pattern email but. when user email is normal and pass email verification service and able to create account in that case they put mobile number and send otp the promblem is occured the all number is valid in lookup api and they rotate the number, IP to prevent throttling.
Currently we do our best. Anyone guide me how we can handle in much efficiently of that kind of problems.
What really matters is the service that provides valid phone numbers. If anyone has information about such services, please help us out.
Let us know whos provider that kind of virtual numbers infinite as i review they use 200 mobile number to send otp.