Spammers Registering Even After I Turned Registration Off ... How ?

[Lynne]

Kevin is talking about your server access_logs. If you don't know where they are, ask your host.

Are you sure these users registered after you turned it off and they aren't simply spammers that registered a few days ago and are now spamming the site?

[DougCooper]

k I'll take a look at the server log. They are registering now and constantly. I've just installed the rename reg page plugin and turned reg back on.

Will report back. but still confused as to how spammers were/are able to register ever after I turn reg off in admincp

[kh99]

Yeah, like Lynne says, if you haven't already, make sure that they are new registrations on not old ones that never posted. As for the logs (assuming they are new registrations), I was thinking get the registration ip of one of them, and then search the web server access logs to see which scripts they accessed.

ETA: Also if you haven't already you might try disabling all plugins. Maybe an addon is inadvertently allowing registration even though you have it turned off.

[DougCooper]

They are new reg's I'm getting constant email alerts.

I'm looking at the log now and trying to make sense of it.

They are obv using proxies to register as each reg has a new IP.

--------------- Added [DATE]1371585348[/DATE] at [TIME]1371585348[/TIME] ---------------

It's stange because they are able to register even with filling in custom required reg fields that I've set as required.

I've just disabled all plugins to see the resuts - good idea.

[skol]

Do you have any primary Users Awaiting Email Confirmation..

[DougCooper]

90725

[Bluemax712]

I would check if your mysql server is exposed either directly via port 3306
or do you have any web- based management tools like Webmin/ Cpanel or PhpAdmin installed?

[af1racing]

Has any solution been found for this? We just received 4500 registrations yesterday, all spammers. They have found a weakness. We turned off the registrations now but we are trying to find out how they are getting by the verification system.

Thanks

[ForceHSS]

Originally Posted by af1racing

Has any solution been found for this? We just received 4500 registrations yesterday, all spammers. They have found a weakness. We turned off the registrations now but we are trying to find out how they are getting by the verification system.

Thanks

Have you installed any plugins to stop spammers if not then you should

[DougCooper]

My issue was I had a lot of spammers registrations that signed up in dec 2012. They didn't activate their accounts until recently via the email confirmation. So have a look at your 'Users Awaiting Confirmation' group and if necessary clean/dump it. This is what happened to me and I was so confused as I'd turn off registations yet they were still registering, but they wern't actually registering at that point, they were simply activating accounts that they registered in the past. Take a look at the signup date of some of the new accounts as look at the registration date.

--------------- Added [DATE]1371744162[/DATE] at [TIME]1371744162[/TIME] ---------------

BTW thanks to everyone who chipped in on this post to help really cool. One question tho, I want to either mass move all the 90000 spammers from 'Users Awaiting Email Confirmation' to either 'Banned by Moderators' group or just delete them. THe problem is in the prune users option in the backend it only seems to do it in around 1000 at a time. Then I have to do it again. This is really time consuming is there a better way ? I've heard running direct database commands is risky.