[pedigree]

ngx - youre dead right. What has happened is that the bot is getting to the "allowed registration" phase as its not been caught by the ip/email/username tests. At this point, its passing control back to vbulletin to process the captcha (etc). This looks like the bot has got the captcha wrong and has tried again and again and again before finally getting it right.

What I will look at is the location of the hooks Im using or a better description so that "allowed registration" only gets logged when vbulletin has done its tests or change it to read "passed vbstopforumspam tests, passing to vbulletin". The intervals being one second would point at it being a bot, not someone botching it. I guess I could look at adding code to the log (if vbulletin doesnt already, would have to check) botch captchas with the user input and what the text was, too see just how far off they are.

Sign up for an API key at stopforumspam.com and submit those spammers details.

Evaporate - thanks. Ive added gmail to my forums banned domain list. Had a couple of people complain but I dont care, they can use something else. Trust google? Hell no. You might want to block mailinator.com as well.