I’m often having a look at my admin/users?sort=newest and I often spot spammers creating accounts (sometimes just one, sometimes tens of them in a row).
To “fight back” spam I sometimes grep their IP in my nginx logs and ban them via an nftable rule, but it’s manual steps, funny to do once or twice, but not every other day.
I’m also hosting a Discourse (same software than forum.gitea.com), in Discourse the admin interface shows the registration IP address and the last seen IP address of users, and when a user is deleted in Discourse there’s an option to block its IP address.
This make me think: why not having the same feature in gitea? An IP block list and a “also block this IP address” checkbox when deleting a user?