Malicious leads via form submits - how to remove?

Dan_Stevens_
Level 10 - Champion Alumni

Malicious leads via form submits - how to remove?

While running a report in RCE today, we came across hundreds of leads that were created maliciously (see a sample of the email addresses below).  I tried to run a smart list so that we could delete them, but there's no way to produce a list of leads like this outside of RCE.  Therefore, how do we remove these from Marketo?

pastedImage_0.png

10 REPLIES 10
Josh_Hill13
Level 10 - Champion Alumni

Re: Malicious leads via form submits - how to remove?

I'm confused, why couldn't you run a smart list with STARTS WITH some of these and then delete? Or copy and past these back into a smart list? I've done similar work before.

Sure, if you had REGEX it would be easier to do this.

Dan_Stevens_
Level 10 - Champion Alumni

Re: Malicious leads via form submits - how to remove?

I tried that, Josh, but when including any of these values in the filters (in the smart list), there are no results.  I'm wondering if Marketo hides these records from within the main interface.  If so, why are they appearing in RCE?

Dan_Stevens_
Level 10 - Champion Alumni

Re: Malicious leads via form submits - how to remove?

Josh Hill​, I opened a ticket with Support and they don't even have answer for this yet.  Can you explain how you went about this (what filters did you use - for example, "email address CONTAINS or START WITH" does not work here, etc.)?

Josh_Hill13
Level 10 - Champion Alumni

Re: Malicious leads via form submits - how to remove?

STARTS WITH should work here and you list all the characters in the box

/

?

#

etc///

Dan_Stevens_
Level 10 - Champion Alumni

Re: Malicious leads via form submits - how to remove?

Marketo Support is still unable to figure out what's going on here.  Can I ask others - that have RCE - to see if they experience all of these malicious email addresses within their instance?  Basically, all you need to do is create a new "lead analysis" report and drag the "email address" attribute to a row.  Once the report refreshes, you should see a couple "not available" entries, followed by several malicious entries.

Grégoire Michel, would you mind being a tester here?

Grégoire_Miche2
Level 10

Re: Malicious leads via form submits - how to remove?

Hi Dan,

I do not have access to an instance with RCE for the moment. Probably not before a couple of months, and yet it will take time to get populated.

-Greg

Dan_Stevens_
Level 10 - Champion Alumni

Re: Malicious leads via form submits - how to remove?

Thanks Greg, no problem.  Dory Viscogliosi​, would you be able to test this?

Dory_Viscoglio
Level 10

Re: Malicious leads via form submits - how to remove?

Hey Dan, sorry! We aren't running RCE yet... Within the next few months we will be, but budget has to get pushed through 😕

SanfordWhiteman
Level 10 - Community Moderator

Re: Malicious leads via form submits - how to remove?

Hey Dan Stevens​, I don't see any RCE-only malicious addresses here.

Have you tried using the API to see if you can access (and delete) them that way?