New Account Spam


I just launched a new site this afternoon (Cupar Garden Centre), but have received quite a few ‘Undelivered mail returned to sender’ emails.

The content of these e-mails is basically a failure to send the account confirmation e-mail because the e-mail address does not exist.

The accounts which have been created use this format, or similar:


User account information


Profile name: Main

Contact information

Mobile: Dogma

Billing address

First name: TultShewStoth

Last name: TultShewStoth

Address: Nuwara Eliya

Address, line 2: Nuwara Eliya

City: Nuwara Eliya

Country: Afghanistan

State/province: Sri Lanka

Zip/postal code: 123456

Phone: 123456

Mobile: Fox and the hound [/quote]

The name/address/country all seem to be random, but the value for Mobile (a custom field), is always the name of a movie.

Is there something wrong with my setup? Captcha is enabled, but doesn’t seem to very effective at all.

Any ideas?


Shall answer my own question here.

Settings > Image Verification

Enable 'Register forms' under the 'Use for' heading.