Hello Jumbo,

do you have any idea or knowledge why bots are able to register with just an email and username when I have other mandatory fields enabled?

The screenshot which you shared is of VirtueMart's registration form. However, you can also register by posting a request directly to the core Joomla user registration controller. You do not have to comply with these required fields for core Joomla registration. The robots usually follow that route. You can block such registration by enabling a captcha in the Joomla registration form. Many hosting service providers also have built-in systems to protect websites from these attacks, which are known to be very efficient. Additionally, many websites use the Cloudflare service, which has a good bot protection system.

Thank you, Jumbo.

The funny thing is, I have re-captcha enabled, but still get bot registrations.

Although ReCAPTCHA is a useful tool, it is not completely foolproof, and many bots can bypass it. That's why I mentioned other approaches in my post.