The GeoIP block is something of a toy. It is good enough to keep the bots out but a live human will go through it like a hot knife through butter. All they have to do is log into a Canadian proxy server and keep on keeping on. Nicholas tried to remove it from Admin Tools a while back but had crowds of users with torches and pitchforks trampling his flower beds, chanting death threats, etc.
Add to that the fact that the geographic data is provided by a third party service based on where the IP is supposed to be. It doesn't know where the IP is, only where the system thinks it is. It is about 90% accurate on a good day.
And hackers don't actually use their own IP addresses anyway. They use computers that they have infected and remote controlled.
So you slowed them down a bit, that's a good first step. Now you need to require user verification to create an account on your site. That is where the user clicks a link in an email sent by your site to verify their information. That kills the rest of the bots because they just can't do that. You can have Admin Tools delete all the unverified user accounts after x days of inactivity to keep your user list clean.
Dale L. Brackin
Support Specialist
English: native
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
????
My time zone is
EST (UTC -5) (click here to see my current time in Philadelphia, PA)