I have a D6 site that gets a lot of SPAM account registration and they all follow a pattern, however from different IP addresses (often during the following process):
1) User account is created
2) One Time registration link is used to log in
3) account page is visited
4) node/add page is visited
- I am using both a Math captcha AND spamicide on the user registration form.
- Users have to be verified via email.
- Password Reset form also has a captcha and spamicide enabled
- I have found out that some of the email addresses being used are from servers that according to their operators are not in service to send or receive email.
- This often happens within 1-15 min and either from the same IPs or different IPS for the same username.
So, how are the bots logging into my site? How can they get the one-time link token without checking the email account.
EDIT: The email listed in users.mail is equal to users.init for almost all accounts. There are some that have changed but they look like legitimate users.
Any idea on how to stop this would be appreciated.
FAKE User Data:
uid name mail init modesortthreshold theme signature signature_format created access 1975 Gomez.S. sele.99@hotmailit sele.99@hotmailit 0 0 0 0 1359319030 0 0