This question already has an answer here:
I have a Joomla site that allows users registration. Form registration uses captcha plugin that comes with Joomla.
The problem is that I am constantly receiving fake registrations. Most of them, users do not validate account, but a few do.
All fake accounts that are created share the same caracteristics. First, the user name is strange (for example, karenpv3, Richardmacy, HanReal47p, xzusaymeznxxzcf, and so on), the e-mail is clearly, in most cases, invented, the country is generally from east Europe (Russia, Poland, Ukraine, Romania, Germany, Etc.) and the phone number is a number always with the same number of digits.
With the country information, I have used this site https://www.ip2location.com/blockvisitorsbycountry.aspx to block users using Linux firewall (Iptables). On the other hand, I have installed a plugin that sends me an e-mail each time a user registers the site and tells me about the IP address. With that information, I realized that not all network masks are considered in the IpTables. For example, a user came from IP 220.127.116.11 (Russia), however, the site above added iptable entry 18.104.22.168/17 so I have to add manually 22.214.171.124/16 in order to block that whole network.
Since my form has Recaptcha feature, I think it is not a bot who registers but a real human or spammers have found a way to hack recaptcha.
Is there a more effective way to avoid those fake registrations? what spammers or hackers can get with this?