Fake users created without using site registration form but still using overrides?

Question

I am working with a Joomla 3.7.5 site. The registration scheme has always been admin activation from the start. Right now there is a constant deluge of fake Russian user accounts. They aren't getting activated, but the admin is getting spammed by the notifications.

I know that sounds familiar, but this is different than the other Q/As I've seen here. I have also seen this VEL article but it doesn't explain my situation.

I am overriding the core UsersModelRegistration and JMail classes. The JMail override is used to route all system emails through our email relay service. The UsersModelRegistration override is literally a copy of the original with one line added. At the very top of the register function I am just immediately returning, instead of allowing the function to run. The reason for this is because our registration is now done via a custom component. With that modification it should effectively disabled registering in the normal Joomla way. In addition to that, I have added a modification to the com_users controller so it will redirect the register view to the custom registration component. Update: I double-checked and this is how we are handling the redirect, also an override:

public function onAfterRoute() {
        $app = JFactory::getApplication();
        $option = $app->input->get('option', '');
        if ($app->isSite() && ($option == 'com_users' || $option == 'com_jsn')) {
            $task = $app->input->get('task', '');
            $acceptableTasks = array('registration.activate', 'user.login', 'user.logout');
            if (!in_array($task, $acceptableTasks)) {
                $db = JFactory::getDbo();
                $menusql = "SELECT id FROM #__menu WHERE link LIKE '%com_my_custom_component&view=account%'";
                $db->SetQuery($menusql);
                $menuItem = $db->loadObject();
                $menuitemid = (!empty($menuItem)) ? $menuItem->id : 0;
                $regLink = JRoute::_('index.php?option=com_my_custom_component&view=account&Itemid=' . $menuitemid);
                $app->redirect($regLink);
            }
        }
    }

Yet, users are still being created without using the custom form. I can tell pretty easily because every registration on our form will created augmented records in another DB table. These spam users are all the most basic Joomla users. Side note: literally every one of these users I've looked into has a Russian IP address.) They create a user somehow. Since the admin is getting emails for these users, they must also be constructing the URL that verifies their email, although that has to include a hash token and how do they get that? If someone was able to upload a user creation script, why would they be thwarted by the admin activation process? Would they just keep going and get more access? This course of action is annoying, but not profitable or productive for any spammer/hacker.

Has anyone else experienced something like this?

Answer 1

Is there a pattern to the emails used? For example, do these emails have a certain tld at the end? If that's the case, you can add a regex to the model blocking those emails.

Note: If your website only benefits from American traffic, then you can block traffic from countries that we don't want traffic from. Nowadays, most hosts can do that for you. This will save you time and will reduce the attacks on your site. If your benefit from international traffic, then I don't recommend doing this.

Another note: A good idea to understand and (attempt to) prevent the attacks would be to check your server logs.