I have a D6 site that gets a lot of SPAM account registration and they all follow a pattern, however from different IP addresses (often during the following process):

1) User account is created

2) One Time registration link is used to log in

3) account page is visited

4) node/add page is visited

  • I am using both a Math captcha AND spamicide on the user registration form.
  • Users have to be verified via email.
  • Password Reset form also has a captcha and spamicide enabled
  • I have found out that some of the email addresses being used are from servers that according to their operators are not in service to send or receive email.
  • This often happens within 1-15 min and either from the same IPs or different IPS for the same username.

So, how are the bots logging into my site? How can they get the one-time link token without checking the email account.

EDIT: The email listed in users.mail is equal to users.init for almost all accounts. There are some that have changed but they look like legitimate users.

Any idea on how to stop this would be appreciated.

FAKE User Data:

uid     name        mail                init                modesortthreshold   theme   signature   signature_format    created access
1975    Gomez.S.    sele.99@hotmailit   sele.99@hotmailit   0   0   0           0       1359319030  0                   0               
  • When you say that the emails are not in service, are you looking at the users.mail column or the users.init?
    – greggles
    Feb 23, 2014 at 12:03
  • See reply above. Feb 24, 2014 at 18:37

1 Answer 1


I can only think of a few ways this is possible:

  1. There's a vulnerability in the one-time-login link system for new users (I'm not aware of one)
  2. There's a vulnerability in some other module (in which case please give some more details of what modules you are running)
  3. Your server does actually resolve the domain hotmailit or has a default place it sends mail and thus the mail is being delivered to somewhere which is then getting the login link and spamming.
  4. Something about your configuration is different than you've described it (e.g. Users do not have to be verified before posting)
  • Thanks for your help! 1) I did read about a method by which the token can be created (but can't find the article anymore). However I can't see how. 2) Here is a list of modules (I did apply all sec-updates - and anonymized the names): pastebin.com/guFD6ErT 3) I will have to check with the server again, but this is just one example of email addresses. Others are potentially real, but it would be too complex to sign on users within less than 15m & check an email account by the hundreds. 4) Users dont have to be verified to post to one content type (authenticated) and the comments (anon+) Mar 3, 2014 at 17:43
  • I see things like this within 15 - 1hour between first signup and login: notice user New user: manualorlavgqwyjwett ([email protected]). notice user Session opened for marlahagenbkktczq. notice user User marlahagenbkktczq used one-time login link at time 1393761834 Mar 3, 2014 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.