Strange referral from unknow sites

I got some of these too, from ip address 193.37.152.250. I guess it's a spambot hooked up to antigate or one of the other anti-captcha services. Apache logs show they don't access any css/js/image files and they have no trouble breaking recaptcha.

I just added the ip and e-mail addresses to admin/user/rules, we'll see if that helps.

I got one too, from the same ip and email address mentioned above ...just about an hour ago.
I'm using recaptcha in my drupal site too.
I see i'm not the only one thinking there's something fishy about this.
I'll add the ip and e-mail addresses to admin/user/rules too, it seems a good idea.

I have had 3 of these in the last 2 hours, each to different sites running on the same IP. Different user names for each. Obviously blocking the domain in the access rules is the next step.

@poiu : Wasn't aware that captcha was that easy to break - do you know the solution please? I have an image captcha.

I've got several of these, includign megavigor.info, since about 05/01/11. Varying the captcha did absolutely nothing to curb them, including recaptcha.

What I've done until something happens is add stopforumspam integration to my site so I can send these registrations a rejection message with one click. Module spambot does this on D6 if you need it.

I've had the same. My site (artsandego.dylanharris.org) is dedicated to my own modernist English language poetry, so I'll get a new registration every few months. Suddenly I've got a registration a day for a week, -ish. The odd registrations started with one from mail.ru. This ain't my poetry suddenly gone hot in Russia, let me assure you! The questionable domains include megavigor.info, idolsystems.info & zensolutions.info.

They sailed straight through recaptcha. I guess I'd better set up some more anti-spam stuff.

This is queue is for bugs in Drupal core. Please visit http://drupal.org/support to see what your support options are if you need more assistance. You may also find the group http://groups.drupal.org/combating-spam-and-bots useful.

If you discover specific information on how to reproduce a security flaw, please report it confidentially to security@drupal.org. Thanks!

I am having this same problem. I require people to register in order to download music. I have had more than 20 try to subscribe in the past month. In my form they fill in most of the slots and the city is always New York. I get N/A for a first name and usually just a Last Name. THey put New York for state, United States for country and NA for birth day, birth month, birth year.

the user name is usually just a scramble of numbers and letters. no meaning whatsoever. and the emails are the same. scrambled user id at the any of the following:

@zensolutions.info
@idolsystems.info
@aliasnetworks.info
@thebytehouse.info

It seems I get a few from one and then they switch it up. So 3 may come from thebytehouse and then they move to aliasnetworks, and so on.

I am assuming they are all the same company/entity. I googled their company names and they certainly did pop up in New York. I even got a zip code for them once while searching.

if anyone can help me stop this, please let me know. It's getting old.

attached is a screen grab of a typical spam bot registration

Following an earlier comment here, I have installed the Drupal spambot module and registered for an API key on stopforumspam.com. I set the module up to report all spammers. It works a treat. However there are far more attacks and I just wonder if either a sense of challenge or some information from the website attracts more of the scum. Or are they just increasing anyway?

There are similar modules too with links to other tools - but I have not tried them yet.

Guys, I suspect these registrations are not automatic but human driven. I mean there may be a helper program to do it easily but I believe the recaptcha or captcha is ultimately solved by humans not a machine or a computer program. If this is the case threats coming from these sites will never be massive or severe.

My site is not a big traffic one so my approach is having the mail confirmation feature enabled. I simply leave any suspicious registration attempt blocked (ignored) so no request for a confirmation email is sent. Even if I request a confirmation they never reply, so actual registration in my site never completes. So far this has prevented my site from being spammed.

If I am right that some spammers ultimately use humans to solve captcha challenges then no mater what modules or patches you install, they will be always able to break into your site. Possibly low payed people in third world countries is all what they need. This must work, after all this is how global economy has been able to keep growing for the last 30 years.