Same here! On the day I noticed, there were about 1 registration per 5 minutes, some with Cancelled Orders and some without. With advise from my hosting company's technical team, I used "Block Visitors by Country Using Firewall" to block all IPs coming from the suspected countries. This slowed it down considerably, but they soon used VPN sites (through other countries) to carry on this nefarious activities. In addition I have also implemented some of the tips on WHMCS John article. For now it has stopped but I guess it is an ongoing battle.