One-time link without valid email address Spam Registrations I have a D6 site that gets a lot of SPAM account registration and they all follow a pattern, however from different IP addresses (often during the following process):

1) User account is created

2) One Time registration link is used to log in

3) account page is visited

4) node/add page is visited


I am using both a Math captcha AND spamicide on the user registration form.
Users have to be verified via email.
Password Reset form also has a captcha and spamicide enabled
I have found out that some of the email addresses being used are from servers that according to their operators are not in service to send or receive email.
This often happens within 1-15 min and either from the same IPs or different IPS for the same username.


So, how are the bots logging into my site? How can they get the one-time link token without checking the email account.

EDIT: The email listed in users.mail is equal to users.init for almost all accounts. There are some that have changed but they look like legitimate users.

Any idea on how to stop this would be appreciated.

FAKE User Data:

uid     name        mail                init                modesortthreshold   theme   signature   signature_format    created access
1975    Gomez.S.    sele.99@hotmailit   sele.99@hotmailit   0   0   0           0       1359319030  0                   0
I can only think of a few ways this is possible:


There's a vulnerability in the one-time-login link system for new users (I'm not aware of one)
There's a vulnerability in some other module (in which case please give some more details of what modules you are running)
Your server does actually resolve the domain hotmailit or has a default place it sends mail and thus the mail is being delivered to somewhere which is then getting the login link and spamming.
Something about your configuration is different than you've described it (e.g. Users do not have to be verified before posting)