[skippybosco]

Because right now they are using .cn domains 95% of the time so it is easy to take a swipe at good versus bad in the registrations that slip through.

If I ban .cn via vbulletin options they will not be able to register and will switch to alternate domains (this is what happened when I tried to use the Vbulletin banning) and the trend may not be as easy to spot

Today, even though the majority of the registrations are banned as soon as they sign up, they continue to use .cn domains.. my logic is that if I auto ban .cn I can make sure the large majority of attempts are caught without ever having to check an RBL or remote service.

This is all subject to the trend variation obviously.

IP addresses were much to hard of a moving target for me. I spent some time trying to amass large lists of proxies and such (thousands and thousands of addresses) and adding them every time one slipped through. A lot of effort for not much success.

I believe very much in the centralized model where a few take the pain for the many so we stop them in their tracks the first time someone reports an issue.. seems to be doing the trick so far for me!