Hey for months now we have been the target of fake accounts, referencing bots that "discreetly" create accounts with beautiful name's domain like freeliveadultcams and so on.
The only free solution i found was to manually identify those fakes accounts, they usually use a different country from my audience, the email domain is quite explicit, i have a user tour for new accounts but those bots don't "see" it (human user always start the user tour when i check the logs). Actually it could be a way of identifying automatically, delete the account and put the domain mail in denied email domains. Purging those fake accounts require quite a long time.
I'm using recaptcha, my website provider is ovh (mutualized). The other solution i found is to pay for bot management like cloudfare perimeterX imperva etc but the association can't afford the price.
An other solution is to only allow certain email domains like google yahoo etc, problem is my audience comes from a lot of associations that all have there own email domain.
You can copy paste this list (attached file) in site admistration > plugins > authentification > manage authentification > Denied email domains and maybe have an sql query to delete those accounts.
I'm not sure it will be usefull, maybe someone found a better solution than me or you could also share your denied email domain.
For those new to the problem make sure to check Reducing spam in moodle