Shopping cart overload on purpose

[Lee.K]

Someone is loading up my shopping cart with hundreds of items, obviously with no intention of purchasing them, and eventually I get a Merchant Alert because the UPS quote system says it has too many packages. I'd like to ban the IP address of this user from my site but the merchant alert doesn't provide this. It doesn't even provide the time of the alert - just the date and AM. If I had the time at least I'd be able to match it up to my server logs to get the IP.

Any ideas on how to stop these 'attacks'?

I'm running ShopSite® Pro 11 sp2 r5

Thanks,
Lee

[Jim]

The "attacks" are probably a search engine that is following all the links on your pages, many of which would be add to cart links.
You should add a robots.txt file to your home directory that excludes the url to the shopping cart.

Checkout http://www.robotstxt.org/ for some info on robots.txt file usage . A websearch for robots.txt will bring up other helpful pages.

[Lee.K]

I'll add an exclude. I didn't try that since this is a site that's been running for a long time and I've never had this problem before.

Thanks.
Lee

Quick edit... never mind. I just realized I already have the entire cgi-sys directory (where my cart link starts) already disallowed in my robots.txt so this isn't it.

Luckily I haven't had this problem again yet. It only happened on one day (which gave me 8 merchant alerts).

[Jim]

A robots.txt exclusion statement doesn't mean that robots can't access the files it just means that the "good" ones won't. Anyone with some programming knowledge can write a web spider that will crawl websites looking for links and they don't have to obey a robots.txt statement. But the good ones, Google, Bing, Yahoo etc will observer any exclusion statements. If it happens again look in the logs for the IP it is coming from and exclude that IP from access to the server.

[Lee.K]

That was my original question. I want to ban the ip address but the merchant alert doesn't provide this or even provide the time of the alert - just the date and AM. That makes it very hard to match it up to my log (which are very big). I wanted to know if there was any way to get either the ip address or the time of the alert in the merchant alert.

[Jim]

There isn't a way to get either of those, time or IP, with the current version of ShopSite. The next release (sometime this fall) will have the time and IP included in the alert listing found under Commerce Setup > Merchant Alerts and in the email alert.
It will display the date and time like this: Time: Jul 10, 2013 11:30 AM and the IP and some other info like this
IP: 10.1.5.128
Host Name: Not Determined
Cookies Enabled: Yes
JavaScript: Yes
User Agent:
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0

Note that currently the email of the alert being sent out should have a time stamp fairly close to the time where the error occurs. So you might be able to use that to give you a close approximation of the time which you can use to search in the server logs.

[Lee.K]

Thanks.

Good to know of the future improvements. For now my site hasn't experienced this 'attack' since the initial event. I figure if I can make it through the PCI Compliance tests, I can get through anything.