How are spam bots making submissions to civiCRM?

Question

I ALREADY had reCaptcha enabled in civi and on my Profile type, but it seems that spam bots were still making submissions to civiCRM and creating contacts (and got assigned to a group).

I only recently caught it because I turned on role synching between civi and drupal and saw spam accounts popping up assigned a role other than "authenticated".

After going back through the particular group in question (in civi), I noticed that there were contacts that had civi IDs but not Drupal (I'm assuming submissions before I turned on role syncing. I didn't load sample data when I installed civi)

I'm not even sure what the URL would be for the form where bots could create a contact record...

Answer 1

If you have a CiviCRM profile assigned to "Drupal User Registration" (as "Name and Address" is by default, I believe), then spam bots that apply for an account on Drupal will also be inserting fields from that profile into their associated CiviCRM contacts.

If you aren't using the account functionality you can turn it off in Drupal (admin/config/people/accounts) by allowing Admin only account creation. Otherwise you can look into Drupal-specific spam blocking modules such as Honeypot.

There are also some CiviCRM-specific fraud prevention suggestions that may be of interest to you.