WHMCS.Community

I have a WHMCS owned license for a very small company with less than 10 active clients. In the past 2 weeks I have received hundreds of fake new orders + new customer signups from multiple VPN Ip addresses + emails etc. What is common? - All orders are via "PayPal" module. My other payment gateway is stripe, this one obviously will validate and attempt capture, but PayPal doesn't do any of these preflight checks, it creates an invoice straight away which I want to avoid unless a payment is received first. Can this be fixed in any way? My WHMCS version is 8.0.5 (I have no plans to upgrade my fully owned license, the help and fix I am looking to implement should work on this version) - I have added a hook to stop these hackers from using "+" email addresses (e.g: wahoo+2838@gmail.com) are now blocked.  - I have added a hook to "force" users to validate their e-mails that I found on https://github.com/Infinitz-1973/Whmcs-Force-Email-Verify/blob/main/Verify.php = I had high hopes this would stop them, but they found a way to circumvent the hook code? Any help? - I have enabled the "free" FraudLabs Pro plugin - this fails to stop them from creating invoices and fake customer accounts still. The hook that's supposed to ensure clients must be fully e-mail verified... but isnt working is below: <?php if (!defined("WHMCS")) die("Can't access the file directly!"); use WHMCS\View\Menu\Item as MenuItem; use Illuminate\Database\Capsule\Manager as Capsule; # Would you like to prevent unverified accounts from placing orders ?, set it to false to accept orders define("PREVENTUNVERIFIEDORDERS", true); # How many days to wait before deactivating the unverified account, set 0 to deactivate this feature define("DEACTIVATEACCOUNTAFTERXDAYS", 5); # How many days to wait before setting the unverified account as closed, set 0 to disable this feature define("CLOSEACCOUNTAFTERXDAYS", 7); # Orders will not be completed if the email is not verified. add_hook("ShoppingCartValidateCheckout", 1, function($vars){ if (PREVENTUNVERIFIEDORDERS===true){ // get the client data $client = Menu::context("client"); // verifies if the client is logged in and if it is found if (!is_null($client) && $client) { // check if the email is not verified if ($client->isEmailAddressVerified()==false) { // message return array("<b>You must first verify your email address before completing any order</b>"); } } } }); # Deactivate unverified account after x days add_hook("DailyCronJob", 1, function($vars){ if (intval(DEACTIVATEACCOUNTAFTERXDAYS)!==0){ $dateCreated = date("Y-m-d", strtotime("now - ".intval(DEACTIVATEACCOUNTAFTERXDAYS)." days")); $getAccounts = Capsule::table("tblclients")->where("datecreated", "=", $dateCreated)->where("email_verified", "=", 0); foreach ($getAccounts->get() as $account){ Capsule::table("tblclients")->where("id", $account->id)->update(array("status" => "Inactive")); } } }); # Close unverified accounts after X days add_hook("DailyCronJob", 1, function($vars){ if (intval(CLOSEACCOUNTAFTERXDAYS)!==0){ $dateCreated = date("Y-m-d", strtotime("now - ".intval(CLOSEACCOUNTAFTERXDAYS)." days")); $getAccounts = Capsule::table("tblclients")->where("datecreated", "=", $dateCreated)->where("email_verified", "=", 0); foreach ($getAccounts->get() as $account){ Capsule::table("tblclients")->where("id", $account->id)->update(array("status" => "Closed")); } } });  

Dear All Community Members,   We are excited to announce that our Independence Day sale is now live at WHMCS Global Services! Enjoy a fantastic 30% off on all our themes and modules during this special event. Elevate your hosting business with our premium offerings, but hurry—this offer is valid for a limited time only.   Coupon Code: FREEDOM30 The sale is Live till the end of this week, so hurry up https://whmcsglobalservices.com/best-discounts-and-promo-codes-for-whmcs-product-services/    

@DristiTechnologies could you help me with this?

It doesn't actually work properly as it should. WHMCS didn't program its individual page structure like: /supporttickets.php /announcements /submitticket.php The invoices page isn't individual and isn't part of /invoices.php it uses: /clientarea.php?action=invoices meaning the sidebar will display in: clientarea.php This is reflected in others like: /clientarea.php?action=services /clientarea.php?action=products&module=licensing I really don't know what the behavior is in creating a sidebar just for: clientarea.php and not repeating it in other internal pages.  

Over the last 24 h, have you watched your registration form get pile-driven by thousands of obviously fake sign-ups? Mail queues backing up, bounce graphs spiking, domain-rep dashboards turning red? What’s the fastest thing you have bolted on? Disposable-email suppression : live feed or static list? Velocity rules in WHMCS you trust without nuking legitimate mobile users? Post bot attack “all-clear” KPI: What dashboard number tells you the wave is over? Any off-the-shelf fraud plug-ins/APIs you’ve wired in recently that is worth it? Share the real-world fixes below. Happy to compile a crowd-sourced survival guide later on.

As mentioned, I think this module is for http://centralnicreseller.com and not the one we are looking for: registrar-console.centralnic.com

Hello @Negin Email is required filed and based on email only WHMCS consider each client as Unique 

Already available since a while: CentralNic Reseller Software Bundle for WHMCS - WHMCS Marketplace Earlier known as "RRPproxy" and through that brand name also accessible out of older WHMCS Versions natively.

Greetings WHMCS community, I’m Eswar (pronounced as Eashwar). I am a representative and part of the Sensfrx team. Personally, I am a developer and Machine Learning enthusiat. Sensfrx, which focuses on fraud prevention services for hosting providers. As a newbie to this community, I’m eager to learn and then contribute insights to the community. Besides that, I wish to learn from your expertise in building secure, affordable hosting solutions. Up until now, we have assisted WHMCS and hosting platforms in fighting fraud such as account takeovers and chargebacks due to bot attacks in real time. Working with WHMCS, Blesta, WiseCP, and WordPress, the solution provides users with a intuitive dashboard to monitor all risks as well as ensuring compliance to standards like SOC 2 Type II and ISO 27001. For those providers who have budget constraints, features such as real-time bot detection and a customisable set of fraud rules offer a way to secure the platform at an affordable cost. Reach out to me either on Discord or through our helpdesk (info@sensfrx.ai) to discuss fraud prevention topics, or check us out in the WHMCS Marketplace for more information. Until then, looking forward to giving back to WHMCS. Best regards, Eswar R B

Dear all community members, we have a special 30% discount on this theme as the Independence Day sale is live, so now you can buy and save money .   Coupon code is : FREEDOM30     Product link: https://whmcsglobalservices.com/clientarea-template/clientx/ Demo Link : https://demo.whmcsglobalservices.com/clientxdemo/