As with Y Ma, I've tried everything - no joy.

I still don't quite understand:

1.  Why the CAPTCHA doesn't prevent the Bot from registering - isn't this effectively a security breach?
2. How, with the verification turned, and a large number of email addresses invalid, the user is marked as valid.
   Another security breach?

I'm currently deleting these entries from the Users table on a daily basis. This has to be done by hand as examination of the record shows do discernible pattern - so that's a real pain. Oddly, only some of the biographies show adverts... So I really don't see the point of this 'attack'. Anyone enlighten me on this?

I was always taught not to bring up problems unless I had suggestions for resolution :)

If I produced a module that sat on a custom registration page that required the user to enter their email address a third time (Along with an explanation why - and removed the CAPTCHA [apparently useless]) , wouldn't this overcome the problem?

Underlying code would would simply match the entered email with the same field in 'Users' and remove if no match. This would also optionally check for multiple email entries...

Anyone see a hole on the logic?

regards,
Duncan.

... After a little testing:

I note that the registration process doesn't pick up the 'LastIPAddress', but does when the newly registered visitor logs back on again.

This may be something the DNN Dev team could resolve as this would allow for checks on multiple entries from a single IP address and, if they can do the registration without notifying the website, that would potentially indicate a SPAM registration.

Naturally, if they can falsify the IP Address this approach wouldn't work....

regards,
Duncan.