I've just recently started getting a LOT of spam registration on a Joomla! website that my company host for one of our clients. I know they are spam because every single user has "https" in the name.
The website is running on Joomla 3.6.0 and can't be updated because an ex-colleague has made changes to the core files (instead of the template files) that are required. The website has user registration disabled, yet I am still seeing all of these spam registrations. I know that the code added by the ex-colleague has nothing to do with the database so that can't be where the registrations are coming from.
The website has VirtueMart 3.0.16 installed, which is being used to sell products (eCommerce plugin).
My question is this: Is there anywhere on the website that is known to still allow registrations, even if the setting is switched off? If not, is there a particular plugin that I can install for this version that will allow me to prevent certain keywords from being used for names and usernames? Because the setting for user registration is turned off, I don't think a plugin will help. My final question is, are there any files that I can edit and add some code to prevent "https" being used in the username/name, for example, where the user's are actually installed?