Spam registration, moderated account with unverified email: how to avoid?

[oci-user]

Hi,
I help to manage a forum for an open-source project.

1. The configuration to prevent spam:

I cannot use Askimet to prevent spam because of license and cost for not individual.
For prevent spam I use different plugin:

• registration question and answer
• spam-Be-Gone plugin

• Askimet: Off (paid option only)
• Project Honeypot: On
• Google Re-Captcha: Off
• Stop Forum Spam: On (free)
• hCaptcha: On (free)

In settings I also activated moderation for duplicate registration from the same IP and I requested also email verification to an account to be active.

2. The issue

Often spam profile are still be able to register and post spam content that is queued for moderation.
Often registration are queued for moderation because a duplicate registration from the same IP are made but want is bad is that also account with a bad IP reputation, no email verification is notified in the moderation queue.

Account that never verify his email address or are in bad list should be not allowed to be in the moderation queue.
If this bad account will be blocked or require to validate IP and email means IP should be not blacklisted from any antispam plugin and email should be verified before the registration can be in the moderation queue, will be much better.

Currently account that are showed with a red X near the IP and near the email in the registration moderation list still create email notification for approval to moderators, still be in the moderation queue when they should be not as they should be blocked.

Seems using the extension spam-Be-Gone plugin never help to prevent fake registration from account with no validated email address and bad IP.
If the IP has been not manually blocked in the NodeBB IP blacklist, this account still be able to be in the moderation queued also if identified as potential spammers.

Should I ask for an extension that never allow accounts to be in the moderation queue if the email address has been not verified and IP is not in some bad list?
No solution exist to improve the reduction of fake registrations and spam?

[phenomlab]

The best way to avoid this is to leverage the post queue. Sadly, spammers always find creative ways to bypass filters, but the post queue will stop them dead.