[thisgeek]

Here's something I'm trying - if you have access to your .htaccess, and mod_rewrite is enabled:

Completely forbid access to your /register.php unless the referrer is coming from your own site (that is, the user clicked the 'Register' link on your site). This prevents bots from directly accessing /register.php.

Just replace "domain\.tld" with your own domain.

EDIT: I've fixed the rewrite code so activations now work.

RewriteEngine On
RewriteCond %{QUERY_STRING} !^a=act&u=(.*) [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?domain\.tld/ [NC]
RewriteRule register.php$ - [F]

Or, if you're inclined, create a sticky locked thread where you rant on a bit at bots, and redirect them to that instead, or use the topic to explain to people that they need to use the register link on the main site instead of accessing /register.php directly.

RewriteEngine On
RewriteCond %{QUERY_STRING} !^a=act&u=(.*) [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?domain\.tld/ [NC]
RewriteRule register.php$ http://www.domain.tld/showthread.php?t=12345 [R,L]

I've only just done this on my site (using the latter option), so I'll see how the spambot registrations go from now on.

This method is probably less painful than renaming register.php. Not sure if it's as effective though.