I've noticed that spammers are adapting to the measures we take to stop them. One thing they do is use a clean IP, one that isn't in any spam database, and use it to register. Once they get past the registration they change IP to confirm registration and more times thnn not that IP will be listed hundreds of time in SFS or other spam databases. While this makes it easier for them and harder for us not many of these spammers actually post so if we don't check each registration we would never see the tactic they now use. Sure some do post right away, but, most don't. The new spammers that do post are adding a zip download to the threads they create. I think these spammers are building an army of users that seem legitimate to be used at a later date for a large scale spam attack and by adding a zip when they do post I think they are trying to build a bigger list of clean IP's to be used. These zips are malware that opens a public VPN connection that is well hidden on the infected computer, but, easy to find for the spammers use. There are ways to combat this. There are some similarities to these sign ups. For one they all set their gender to female. I think whatever automated bot they use to register makes random changes to some profile fields to make it look like a real person is registering. Changing gender seems to be the popular one to use. These users also seem to like to use an age in range of 25 to 42.They also use some random user name with a mixture of numbers. By them registering this way it makes it easy to pick out the new sign ups that could be a problem. In conclusion be on the lookout for users that sign up with one IP and then confirm with another and if the user name is random numbers and letters and are of the female gender in the age group 25-42. While there might be a legitimate user in the group my experience over the last week has shown that these are spammers.