Tons of bots creating and abandoning carts

Shopify Discussion

Topic summary

Shopify merchants are experiencing widespread bot attacks creating fake abandoned carts and customer accounts, severely corrupting analytics and conversion metrics. The bots use rotating IPs (18,000+), bypass traditional captcha and bot protection apps, and trigger cart events directly through backend APIs rather than the storefront UI.

Key characteristics of the bot traffic:

  • Email patterns: names followed by three numbers (e.g., allen690@yahoo.com)
  • Common fake address: House Number 43, Gray Colony, Bellevue WA 98006
  • Customer creation source shows as “Shopify App”
  • Thousands of fake profiles daily since November 2024
  • Corrupts Klaviyo email marketing data with bounces and fake checkout events

Shopify’s response:
Merchants report that Shopify support, including Plus-level support, has been unhelpful—recommending ineffective app-based solutions rather than implementing platform-level fixes at the Cloudflare WAF layer.

Proposed solution:
Some users implemented third-party WAF solutions (Akamai-based) that sit in front of Shopify as an origin-to-origin CDN layer. One user promotes “Armex: Block Checkout Bots” app as a working solution, though other merchants express skepticism about its legitimacy and connection to similar apps. One merchant reports DNS errors after installation.

Status: Ongoing issue with mixed reports—some seeing temporary relief, others experiencing continued attacks. Community frustration with Shopify’s lack of platform-level action remains high.

Summarized with AI on October 23. AI used: claude-sonnet-4-5-20250929.
27

I don’t know if this is just a coincidence. I know best practice is to unsubscribe instead of delete known bad emails. However a few days ago i just got so frustrated at the 90K plus emails clogging up shopify and omnisend (our version of klaviyo). Even though we had been mainly successfully quarantining them with rules based segments (no orders, less than 5 page visits including checkout). I went ahead and DELETE this segment. Then 100 more per hour. Then delete again after another day and 2000+ bad emails. Repeat repeat repeat. Last time i mass deleted was about 3 hours ago and i only have 28 new bot emails. So maybe actively deleting does something to the sender to slow it down? I’m sure i deleted a handful of legit customers (at least subscribers, not customers since anyone who has made a purchase is not in the bot segment).

Will post again if i truly see a big slowdown that endures.

1 Like