Hi
I have a site which has been seriously attacked by spam registrations as early version DNN7.
1. I removed unauthorised users (65,000) which led to huge numbers of page not founds in Site error logs as they attempted to access their profile page.
2. Regularly cleaned the databases including log files using Aderson's and Sebastian's great scripts.(Thanks guys)
3. After a while either the scripts stopped working, or we were going to change site anyway (I cant remember exactly), we rebuilt clean site as portal/1 on DNN 7.4.0
4. Site registration has always been None on both sites since the rebuild.
5. Portal/0 site was always clean - no spammers.

Issues

1. Our server CPU is being hammered by these spammers attacking this site (portal/1)
2. Noticed about  a week ago our new clean portal/1 will not accept image uploads. Content editor hangs, after a while, click cancel, which actually saves changes.
3. It seems to have lost the licence key on Superform (portal/0 and /1), which I cannot now add back in. - developer suggests the website doesnt have write permissions to the folder (which it does).
4. 2 days ago, portal/0  had a new spammer register on the site even though registration is None and I cannot load a register page. He is unauthorised, but I foresee portal/0 now ending up in the same mess as portal/1.  Google analytics implies bot? only went to / (home) page
   
   please help - the database clean up tools recommended by Sebastian and Aderson no longer work, Registration is None, and site is unmanageable.
   
   Thanks

This won't address the underlying registration issue but it could at least block the spammer.

If the traffic is coming from a specific or IP range then you could use the web.config and rewrite rules to block the offender.  I use the code below on a pure asp.net site but please note I have not tested this on a DNN installation.  It should work but it should be done with care and by someone familiar with web config files.   I left a few examples of a single IP block and a range block.  This will drop the traffic and you will not see an entry in the IIS log files for the blocked IPs.