Malicious leads via form submits - how to remove?

[Dan_Stevens_]

While running a report in RCE today, we came across hundreds of leads that were created maliciously (see a sample of the email addresses below).  I tried to run a smart list so that we could delete them, but there's no way to produce a list of leads like this outside of RCE.  Therefore, how do we remove these from Marketo?

[Josh_Hill13]

I'm confused, why couldn't you run a smart list with STARTS WITH some of these and then delete? Or copy and past these back into a smart list? I've done similar work before.

Sure, if you had REGEX it would be easier to do this.

[Dan_Stevens_]

I tried that, Josh, but when including any of these values in the filters (in the smart list), there are no results.  I'm wondering if Marketo hides these records from within the main interface.  If so, why are they appearing in RCE?

[Dan_Stevens_]

Josh Hill​, I opened a ticket with Support and they don't even have answer for this yet.  Can you explain how you went about this (what filters did you use - for example, "email address CONTAINS or START WITH" does not work here, etc.)?

[Josh_Hill13]

STARTS WITH should work here and you list all the characters in the box

/

?

#

etc///

[Dan_Stevens_]

Marketo Support is still unable to figure out what's going on here.  Can I ask others - that have RCE - to see if they experience all of these malicious email addresses within their instance?  Basically, all you need to do is create a new "lead analysis" report and drag the "email address" attribute to a row.  Once the report refreshes, you should see a couple "not available" entries, followed by several malicious entries.

Grégoire Michel, would you mind being a tester here?

[Grégoire_Miche2]

Hi Dan,

I do not have access to an instance with RCE for the moment. Probably not before a couple of months, and yet it will take time to get populated.

-Greg

[Dan_Stevens_]

Thanks Greg, no problem.  Dory Viscogliosi​, would you be able to test this?

[Dory_Viscoglio]

Hey Dan, sorry! We aren't running RCE yet... Within the next few months we will be, but budget has to get pushed through 😕

[SanfordWhiteman]

Hey Dan Stevens​, I don't see any RCE-only malicious addresses here.

Have you tried using the API to see if you can access (and delete) them that way?