I solved this problem with a few techniques together:
1. ACP > Configuration > Settings > Login and Registration Options >
Registration Method = Send email verification (requires user to validate their email address)
Display Hidden CAPTCHA = YES
Minimum Registration Time = at least 20 seconds
Show Security Question = YES
2. ACP > Configuration > Security Questions > make a more interesting question that is harder for bots to solve.
3. If a person or a bot gets past all of those tests, MyBB moves the user from the "Awaiting Activation Group" to the "Registered" Group, which has permission to post freely. So the idea is to modify the Registered Group so that the first post by any user must be moderated - meaning approved by you - before they appear on the forum. This effectively blocks spam, although you do have to go in and "approve" legitimate posts regularly, and delete the spam - but it's easy to do. Then, you create a "Promotion" system that if any Registered user has at least 1 post (meaning you approved their post), then they are "promoted" to a new "Approved" group, which can then post freely.
https://community.mybb.com/thread-186873.html
Here's how:
Make a backup first: in ACP > Tools & Maintenance > Database Backups
1. In ACP > Users & Groups > Groups > Add New User Group
Title: Approved
Copy Permissions From: "Registered"
Click "Save User Group"
2. In ACP > Users & Groups > Groups > Registered Group > Forums and Posts > Moderation Options:
Check: Moderate new posts
Check: Moderate new threads
Click "Save User Group"
3. In ACP > Users & Groups > Group Promotions > Add New Promotion
Title: Promote Registered to Approved
Promotion Requirements: select "Post Count"
Post Count: 1 "Greater than or equal to"
Original User Group: select "Registered"
New User Group: "Approved"
User Group Change Type: "Primary User Group"
Click "Save Promotion"
4. In order to promote all of your existing Registered users to the new Approved Group - so that they can still post freely:
ACP > Tools & Maintenance > Task Manager > Promotion System > Run Task
This way, any new "Registered" user who passes the Registration and email verification, will still have their first post held for approval. Once you approve a post, the user is moved to the "Approved" group and can post normally.
Last, most of our problem registrations were coming from users hiding behind VPN or TOR nodes. There is a plugin called "chkProxy" which can block registration if the user is behind a proxy/VPN... I don't endorse the plugin and have not used it, but it looks like it is up to date.
https://community.mybb.com/mods.php?acti...w&pid=1280
I'm not sure if any of that will help with bots specifically, but it does help to filter out most problem registrations, and stop spam before it appears.