texturedshroom wrote:The easiest way to reduce all this spam would be to require email addresses for registration again
Spambots can very much defeat email verification. I've first noticed them doing that around 2001 and since then most of them seem to have that feature.
Modern bots go much further. They use gmail.com addresses, they simulate a delay before they "click" the activation link, they simulate cookies and other browser behavior. Some even use actual browser engines in the background.
Update: Just did a quick experiment: I sent a fake verification email to one of the addresses used by the spambot that has been plaguing us the last couple of days. All links were requested from a server in China using "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;)" as the user agent. So yes, the exact bot we are dealing with wouldn't be stopped by email verification unfortunately.
texturedshroom wrote:What about just making the registration a little bit harder? I guess you all know this capture-codes?!
Spambots are
perfectly capable of solving CAPTCHAs.
The arms race has moved on. Recently our side scored a big win with initiatives like StopForumSpam where honeytraps were set up and spammers' IPs blacklisted. That's the reason we managed to stay spam free for several months.
Now they've struck back by deploying spambots on botnets rather than on centralized servers as well as by blacklisting honeytraps. A Ukranian friend of mine is much deeper in this whole scene than I am and he says that there are now systems that cross-reference the ratio by which an IP is blocked with the forums that node spammed beforehand in an effort to
automatically detect honeytraps.
My first reaction when we had new spam was to tighten our IP filters. That worked for a week or two, now we are getting spam from completely clean IPs. I guess the arms race has moved on again and we have to find something new.
For now I've just added a new feature which poses a simple question during registration. The only purpose is to make our registration deviate from the standard one, it's perhaps the oldest trick in the book, but still a very effective one as long as your site isn't so big that spammers will actually take the time to create bots for your site specifically.
In terms of what's on the horizon - One service I've heard good things about is
Akismet. Currently it's only for Wordpress, but they might very well branch out to forum software as well.
. 
.
