How to avoid frequent spammers in my Joomla site [duplicate]

Question

I have been experiencing spamming in my website for a long time, following are two things i want to stop -

1.stopping fake/bad user registration 
2.stopping posting bad topics in my kunena forum 

I have captcha and registration confirmation email enabled when new users registers in my website, but still many fake users are registering, most of their emails ending in mail.ru and yandex.com. For this in my gmail account i am getting too many delivery incomplete and registration pending approval emails because most of those emails not exists and have many restrictions so that their registration is not being complete, i want to stop all these emails too.

I have done many researches about how to stop them, i got users' ip addresses from k2 user list and added those ips in restricted list from my server control panel but all those ips different and how long i can do that?, I found recommendations from experts to use EasyCalcCheck extension but it's not free and i can't use it after installation, also i checked akeeba admin tools extension but did not see any settings for this yet.

One thing spinning in my mind if they were using bot when registering then could they pass captcha input restriction? so some measurements like putting hidden inputs and asking to answer questions before registering may not work because they are freaky minded human registering themselves not any bot or am i wrong?

So i need very strong suggestions about what to do to stop fake/bad user registrations(6/7 registration attempts on avg each day) and posting bad topics in kunena forum(on topic posting, i set captcha challenge for users in kunena settings and tried other available settings). FYI i am using CB for registration.

Update: I think this question is not exact duplicate of any other questions(like this one), reasons are that i addressed two concerns that is not only to deal with fake/bad users but also to deal with posting bad topics in my kunena forum.Also there are differences between what I and other authors wanting to get by these questions.

There are not many posts of this kind and it does not match exactly with any questions, so just keep it so that community gets benefitted from it.

Answer 1

_{Note: This answer has been updated a few times.}

As answer to your comments:

Hardly there will be so many real humans that will do nothing else than creating a fake account to your site every day, so most likely these are bots.

In addition, I don't think there is a way you can completely stop a real human from using something offered on your site.

Though, my answer on the other question that is proposed as a duplicate covers, what you need.

For example:

• ProjectHoneyPot can help with bots and humans (with prior bad activity detected).
• AdminTools Pro: you can block certain email domains, e.g. mail.ru
• Bad Words Blacklists (admin tools pro).

But again a real human, could use another email the next time. Especially community-driven websites (e.g. social sites/blogs, forums etc) always need some sort of human moderation.

Take for example StackExchange network of sites. Although that huge network, it still depends on the community, the good will and the users and moderators to fight spam.

I really can't think of a system that could be 100% accurate to detect a real human that would register to post spam.

The final answer is a combination of actions you have to do, which mostly are described in my other answer.

Eventually someone could build certain functionality to detect and block certain behaviors - but again this usually can't work without the behavior occurs first.

How to stop (fake) users from registering on my website?

Update:

Do note that there are other similar security/anti-spam services like ProjectHoneyPot. For example: CloudFlare and Sucuri offer extra layers of protection and many security related features.

Also, do take into consideration @Lodder's comment below your question about the captcha version, the registration workflow (e.g. activation by email, or admin approval) and the script about auto-deleting non-activated users. I think Admin Tools Pro (inside the system plugin) provides this feature.

Another Update

Another tip is that you could block countries by IP, if your users are coming only from a certain country and the spam users come from others.

Again I don't know of what other kind of answers your question can trigger, as it remains kinda broad and general. Also you haven't mentioned if you have implemented any of the possible solutions that have been suggested already and what the result was.