you do not need to move your login pages - that was a workaround that provided a level of "security by obscurity" as the automated script looked for a fixed page name. In 7.3.2 we fixed a critical error in the captcha logic that allowed a single cracked captcha (either automated or manual) to be used to create multiple accounts - this has resolved the issue for almost everyone. A few sites still report getting a (dramatically reduced) number of new accounts registered but upgrading to 7.3.2/7.3.3 has fixed this for most people. Note: we have reports from a few people who put recaptcha solutions in place and they still see a few automated registrations so this would suggest either a particularly good automated captcha-cracker, or (more likely) that captchas are being cracked by humans, either paid or via redirects (e.g. where a captcha image is copied to another site where a user must supply an answer to it to gain access to content - there are plenty of examples of sites hosting free xxx content that use this approach to solve captchas on 3rd party sites)

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US

Dear Cathal

You mean If I remove reCAPTCHA and return to DNN CAPTCHA this 10-20 Spam Per day will finish or will very less?

"Sites that have enabled verified registration typically do not see this issue as the spam accounts do not use real email addresses"

How can anyone say they don't use real email addresses.   The issue is they are using real email addresses because I have people emailing me about being registered or having a verification for registering.  Maybe not all but this is an issue which should make you even more concerned because it is making dnn based websites look really bad (for the owners).

I upgraded to 7.3.2 the day it came out.   It has not solved the problem.   I have captcha on, it has not solved the problem.    The ONLY one of many dnn websites I have that is not having the problem is one that I moved the login page to a new name (as suggested somewhere in the forums).   That is a great idea..  and one that dnn could have scripted into 7.3.2 very easily.

cathal connolly wrote:

What about this statement do you not believe is true -we checked and only admin/host users can view profiles of unverified users. If a spammer is creating new accounts when verified is enabled then those accounts have no value to them as noone will ever view the spam.