Answers.Body: <p>Since a Joomla user is created, there are one of a few scenarios you could be encountering:</p>
  <h3>Joomla's user registration isn't disabled</h3>
  <p>I don't know how to disable user registration in Joomla, and there are some scenarios where you can't. Your mitigations are:</p>
  <ul>
  <li>Turn off user registration (only admins can create users).</li>
  <li>Edit your web server configuration to return a 404 error on the User Registration.</li>
  <li>Check for Joomla-specific plugins to catch spam user registrations.</li>
  </ul>
  <h3>A Civi profile is configured to create a Joomla user</h3>
  <p>Profiles can create CMS users.  Check your profile settings to see if this is applicable to you - either one by one at <strong>Administer » Customize Data and Screens » Profiles</strong>, or with this SQL: <code>select id, title from civicrm_uf_group WHERE is_cms_user = 1;</code>.</p>
  <p>If you have any, you can try to isolate the particular profile by adding users to a different group per profile.  Simple mitigations here are just ReCAPTCHA</p>
  <p><strong>Reading web server logs</strong></p>
  <p>Finally, if you know how to read web server logs, check the <code>created_date</code> on one of the spam submissions, and find the timestamp in your web server logs that corresponds.  It will show you the URL accessed that led to the user being created.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-02-14T19:03:22.147Z
Answers.LastActivityDate: 2021-02-14T19:03:22.147Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.Body: <p>One of the steps we did in Civi was to set our Available Countries. This does not allow user registrations unless they are from within one of the countries on the list. Most of the spammers are operating in specific countries, so if you are not needing the whole world to have access to your forms, then you can do this to block out a large % of these guys.</p>
  <p>Admin&gt;Localization&gt;Languages,currency,locations then scroll down to Available Countries and add the one(s) that matter to the approved list</p>
  <p>Joomla might have something similar as well that you can add there.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-02-13T16:36:15.483Z
Answers.Text: Our "Available Countries" has always been set to only the US and Nicaragua. That only applies to address fields, not to restrictions on IP locations. I've restricted some IPs, but the robots are coming from all over the place including countries we don't want to give blanket restrictions to.
Answers.UserDisplayName: Phil Morice Brubaker
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-02-13T18:43:03.707Z
Answers.Text: Opps, I guess that would just be for address fields
Answers.UserDisplayName: Iowa Boy
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-02-13T02:58:06.250Z
Answers.LastActivityDate: 2021-02-13T02:58:06.250Z
Answers.UserDisplayName: Iowa Boy
Body: <p>Some months ago we started getting a bunch of robot spam users registering on the website. Both a CMS (Joomla 3.9.24) and Civi (5.33.2) user/contact are created with only firstname, lastname, and email. Here's what I've investigated:</p>
  <ol>
  <li>I checked to make sure the reCaptchas were functioning and increased those settings.</li>
  <li>I've looked at the Civi logs and tried logging page activity in the CMS (with extensions), but I'm not finding any clues as to what page these robots are registering on. It's clearly a Civi-related page, because a Civi contact is created.</li>
  <li>I disabled the public mailing list sign-up profile temporarily and still got robot registrations.</li>
  <li>I've changed the settings on public &quot;stand alone&quot; profiles to send me a notification email when someone uses them. Still getting registrations without any Civi notification.</li>
  </ol>
  <p>What are some next steps to help me figure out where these are coming from and how to stop them? I know there is a Civi extension to up the game with reCaptcha, but if I'm not sure what page/profile to deploy it on, I'm not sure how that would help.
  <a href="https://i.sstatic.net/xL5sj.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/xL5sj.png" alt="enter image description here" /></a></p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-12T19:07:27.193Z
Comments.Text: On the contact summary tab, the fourth one down is Source. That will tell you where the contact registered. Then you can focus on that form and implement reCaptcha etc as needed
Comments.UserDisplayName: Iowa Boy
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-12T19:21:12.507Z
Comments.Text: Actually, there is nothing in the Source field. That would be helpful, though. Let me add a screenshot.
Comments.UserDisplayName: Phil Morice Brubaker
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-12T19:24:56.720Z
Comments.Text: in one case i went through the db adding a unique email for each profile so i was cc'ed on submissions and could work out which were being used. just a thought. eg pete+1@mydomain, pete+2@mydomain etc where '1' and '2' were the profile ID
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-12T19:25:49.653Z
Comments.Text: other place could be (i don't know Joomla) equivalent of drupal /user/register, in case any of your profiles are set up for 'user creation'
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-12T19:26:56.960Z
Comments.Text: oh of course my first comment should only relate to profiles set for 'create cms user' but with tools like civirules and cmsuser extension it is possible to trigger a user creation after a profile submission so it these would obscure my first suggestion.
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-13T00:22:56.137Z
Comments.Text: Hey Phil, we are seeing the exact same thing with the last two letters of first and last in caps. We've audited all our forms and no luck. It seems like they are bypassing form logic. DM in mattermost of you want to work on this together.
Comments.UserDisplayName: Andy Burns
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-14T11:50:16.087Z
Comments.Text: What settings do you have for your Joomla reCaptcha plugin?  Also it actually doesn't sound like it's necessarily a civi page because a new Joomla user should create a Civicrm contact.
Comments.UserDisplayName: Elin
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-14T17:45:24.060Z
Comments.Text: @Elin I didn't realize that Civi created contacts based on Joomla registrations! That would certainly change how I approach this problem.
Comments.UserDisplayName: Phil Morice Brubaker
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-15T17:54:08.440Z
Comments.Text: @Elin, I just tested this, and the front-end creation of a Joomla user did not result in creation of a Civi contact.
Comments.UserDisplayName: Phil Morice Brubaker
Tags: <profile><recaptcha>
Title: Stopping robot registrations
ThreadText: # Stopping robot registrations
  
  (Asked by: username_0 on 2021-02-12)
  
  Some months ago we started getting a bunch of robot spam users registering on the website. Both a CMS (Joomla 3.9.24) and Civi (5.33.2) user/contact are created with only firstname, lastname, and email. Here's what I've investigated:
  
  1. I checked to make sure the reCaptchas were functioning and increased those settings.
  2. I've looked at the Civi logs and tried logging page activity in the CMS (with extensions), but I'm not finding any clues as to what page these robots are registering on. It's clearly a Civi-related page, because a Civi contact is created.
  3. I disabled the public mailing list sign-up profile temporarily and still got robot registrations.
  4. I've changed the settings on public "stand alone" profiles to send me a notification email when someone uses them. Still getting registrations without any Civi notification.
  
  What are some next steps to help me figure out where these are coming from and how to stop them? I know there is a Civi extension to up the game with reCaptcha, but if I'm not sure what page/profile to deploy it on, I'm not sure how that would help.
  [![enter image description here](https://i.sstatic.net/xL5sj.png)](https://i.sstatic.net/xL5sj.png)
  
  **Tags:** profile, recaptcha
  
  > **Comments:**
  > **username_1**: On the contact summary tab, the fourth one down is Source. That will tell you where the contact registered. Then you can focus on that form and implement reCaptcha etc as needed  
  > **username_0**: Actually, there is nothing in the Source field. That would be helpful, though. Let me add a screenshot.  
  > **username_2**: in one case i went through the db adding a unique email for each profile so i was cc'ed on submissions and could work out which were being used. just a thought. eg pete+1@mydomain, pete+2@mydomain etc where '1' and '2' were the profile ID  
  > **username_2**: other place could be (i don't know Joomla) equivalent of drupal /user/register, in case any of your profiles are set up for 'user creation'  
  > **username_2**: oh of course my first comment should only relate to profiles set for 'create cms user' but with tools like civirules and cmsuser extension it is possible to trigger a user creation after a profile submission so it these would obscure my first suggestion.  
  > **username_3**: Hey username_0, we are seeing the exact same thing with the last two letters of first and last in caps. We've audited all our forms and no luck. It seems like they are bypassing form logic. DM in mattermost of you want to work on this together.  
  > **username_4**: What settings do you have for your Joomla reCaptcha plugin?  Also it actually doesn't sound like it's necessarily a civi page because a new Joomla user should create a Civicrm contact.  
  > **username_0**: @username_4 I didn't realize that Civi created contacts based on Joomla registrations! That would certainly change how I approach this problem.  
  > **username_0**: @username_4, I just tested this, and the front-end creation of a Joomla user did not result in creation of a Civi contact.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_5 on 2021-02-14. Score: 1
  
  Since a Joomla user is created, there are one of a few scenarios you could be encountering:
  
  ### Joomla's user registration isn't disabled
  
  I don't know how to disable user registration in Joomla, and there are some scenarios where you can't. Your mitigations are:
  
  * Turn off user registration (only admins can create users).
  * Edit your web server configuration to return a 404 error on the User Registration.
  * Check for Joomla-specific plugins to catch spam user registrations.
  
  ### A Civi profile is configured to create a Joomla user
  
  Profiles can create CMS users. Check your profile settings to see if this is applicable to you - either one by one at **Administer » Customize Data and Screens » Profiles**, or with this SQL: `select id, title from civicrm_uf_group WHERE is_cms_user = 1;`.
  
  If you have any, you can try to isolate the particular profile by adding users to a different group per profile. Simple mitigations here are just ReCAPTCHA
  
  **Reading web server logs**
  
  Finally, if you know how to read web server logs, check the `created_date` on one of the spam submissions, and find the timestamp in your web server logs that corresponds. It will show you the URL accessed that led to the user being created.
  
  
  ---
  
  ### Answer by username_1 on 2021-02-13. Score: 0
  
  One of the steps we did in Civi was to set our Available Countries. This does not allow user registrations unless they are from within one of the countries on the list. Most of the spammers are operating in specific countries, so if you are not needing the whole world to have access to your forms, then you can do this to block out a large % of these guys.
  
  Admin>Localization>Languages,currency,locations then scroll down to Available Countries and add the one(s) that matter to the approved list
  
  Joomla might have something similar as well that you can add there.
  
  > **Comments:**
  > **username_0**: Our "Available Countries" has always been set to only the US and Nicaragua. That only applies to address fields, not to restrictions on IP locations. I've restricted some IPs, but the robots are coming from all over the place including countries we don't want to give blanket restrictions to.  
  > **username_1**: Opps, I guess that would just be for address fields  
  
  ---
  
  