Yesterday and today I received about 20 spam registrations on the site. They are not complete registrations (not active users) probably thanks to the captcha and email verification settings, but I am still worried about these inactive users since they might be security threads in the long run and they use resources such as system emails in an unwanted way. I'd appreciate your help. Thanks in advance!

Hi Mariana,

it sounds like you are doing what you can with trying to stop spam, even with the best systems and the highest security settings nothing can stop human spammers, there are thousands of them unfortunately

Some tips to try and keep your site spam to a minimum
1. Make sure you are using recaptcha
2. akismet.com/ this is an option but a paid one. It does reduce spam a lot so may be a consideration if it gets really bad

On jomsocial.com we get spammed mainly by human spammers as we have all of the above in place. Their registrations look like they are robots registering but are in fact people manually doing it. Last night around 30 posts came in this way. The only thing to do is to ban/block them and remain vigilant on your site to minimise exposure to your site users.

Thanks for your answer
Is there any way to learn the attacker's IP so I can block it in.htaccess?
That could be a way to stop them if they are human spammers. At least I can try...

Hi Mariana,

from my experience every time they do it they come from a different IP address. They often use proxy servers and IPs that often have a completely different range. last nights 30 posts that we got all came in within about 10 -15 minutes and all were on totally different ranges .

There are tools around that you can use to block traffic from certain countries and similar but a site that is well maintained, Joomla is always patched. you have main stream components on your site these components are normally a bit of an overkill.
www.akeebabackup.com/products/admin-tools.html

The best way to deal with them is to block them and not delete the account. This does seem to minimise their ability to use the same email address again.

It is a constant issue for a lot of people including us and we have some very sophisticated processes in place to stop it but they always manage to get it though from time to time

Ok. But just to discard it... where can I see the IPs?

One more detail...most of these users emails are @163.com or technidem.fr. Can I just block all users from these emails?

Hi Mariana,

You could block those domains at sever level but are you sure it wont impact legitimate visitors to your site. The only way to see users ips is either in the server logs or i think there are some components that record the IP in joomla