text: Q:
  
  Why do I keep getting fake sign ups on my website?
  
  I have a website and it is starting to get more users. To use the services offered by the site, a person has to sign up. The sign-up requires an email, password, and a five-number string for recapcha. To prevent bot-generated accounts, the form is timed. Recently I have noticed that some toofast sign-up attempts (1.5 seconds for example). These sign up attempts always enter info such as:
  email: an valid email
  password: How get online newbie from $9575 per day (just an example)
  recapcha string: (missing)
  
  These sign up attempts will certainly fail because of being faster than the minimal required seconds. Note that for these invalid sign ups, the website always shows a fake "success" page (instead of 404 or something). The purpose is to prevent the bots from keep guessing the security on this form.
  My question: why do they (attackers? bots?) keep trying such sign up attempts? Because of showing a fake "success" page?
  
  A:
  
  Bot developers don't care that much about failure scenarios, because there are much more different failure scenarios than success scenarios. "Supporting" each of the failure scenarios is more expensive than just letting them happen.
  
  