Answers.Body: <p>Is it always exactly the same number of minutes?
  If yes: could be cron related</p>
  
  <p>If no: 
  sounds more like a spammer. I would first look in apache/nginx logs and try to find at the time the user is created what exactly happened, which requests are done. First try to get the IP address of the visitor that entered the webform, then search through logs with that IP address and see what it does exactly. Is it the same IP address doing all the submission or not.
  That could lead to clues of what to do.</p>
  
  <p>It definitely makes sense to apply anti-spam techniques to your site. </p>
  
  <ul>
  <li>Mollom (<a href="https://www.drupal.org/project/mollom" rel="nofollow">https://www.drupal.org/project/mollom</a>)</li>
  <li>Http:bl (<a href="https://www.drupal.org/project/httpbl" rel="nofollow">https://www.drupal.org/project/httpbl</a>)</li>
  <li>Google Recaptcha (<a href="https://www.drupal.org/project/recaptcha" rel="nofollow">https://www.drupal.org/project/recaptcha</a>)</li>
  </ul>
  
  <p>Are all techniques that can be applied to drupal and webforms</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-02-06T10:18:28.693Z
Answers.LastActivityDate: 2016-02-06T10:18:28.693Z
Answers.UserDisplayName: Catorghans
Body: <p>Every 10-15 minutes a new, (almost) blank contact record is being generated in civi. The only clue I have is that the blank record is subscribed to our mailing list. Any ideas?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-02-05T19:34:15.953Z
Comments.Text: one option would be to set yourself up with a bcc off all the webforms and profiles - i know once i had 22 profiles to check this on and just went through putting p1, p2, p3@ourdomain.com via the db to see which were triggering
Comments.UserDisplayName: petednz - fuzion
Tags: <drupal><webform-civicrm><groups><security>
Title: How can I track down a script or form that's generating empty contact records?
ThreadText: # How can I track down a script or form that's generating empty contact records?
  
  (Asked by: username_0 on 2016-02-05)
  
  Every 10-15 minutes a new, (almost) blank contact record is being generated in civi. The only clue I have is that the blank record is subscribed to our mailing list. Any ideas?
  
  **Tags:** drupal, webform-civicrm, groups, security
  
  > **Comments:**
  > **username_1**: one option would be to set yourself up with a bcc off all the webforms and profiles - i know once i had 22 profiles to check this on and just went through putting p1, p2, p3@ourdomain.com via the db to see which were triggering  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2016-02-06. Score: 2 | Accepted answer
  
  Is it always exactly the same number of minutes?
  If yes: could be cron related
  
  If no:
  sounds more like a spammer. I would first look in apache/nginx logs and try to find at the time the user is created what exactly happened, which requests are done. First try to get the IP address of the visitor that entered the webform, then search through logs with that IP address and see what it does exactly. Is it the same IP address doing all the submission or not.
  That could lead to clues of what to do.
  
  It definitely makes sense to apply anti-spam techniques to your site.
  
  * Mollom (<https://www.drupal.org/project/mollom>)
  * Http:bl (<https://www.drupal.org/project/httpbl>)
  * Google Recaptcha (<https://www.drupal.org/project/recaptcha>)
  
  Are all techniques that can be applied to drupal and webforms
  
  
  ---
  
  