If you site ranks highly enough for certain valuable keywords and the bad guys start specifically targeting you, a lot of these countermeasures are useless.
I get comment spam on some sites that I'm 99% sure is being posted by a human using a regular browser at an internet cafe in China.
If you're being targeted by humans, you're right, nothing you can really do. If they are using automates systems to target you best thing to do is start IP banning.
Ever since my forum got popular, I've had non-stop trouble with human spammers. Straight up IP banning doesn't work. Too explicit and obvious.
A better solution is to let them register, but check all registration/post IP addresses against the blacklist. If they match, unobtrusively move them into a usergroup that just seems like your site isn't working that well.
A better solution is to let them register, but check all registration/post IP addresses against the blacklist. If they match, unobtrusively move them into a usergroup that just seems like your site isn't working that well.
Reddit uses a similar system called shadow banning. When a user is shadow banned, they think their content and submissions make it through, but they actually are hidden to other users. On rare occasions, real users can accidentally get shadow banned; this is not ideal, but shadow banning is effective enough that the sacrifice is made.
I get comment spam on some sites that I'm 99% sure is being posted by a human using a regular browser at an internet cafe in China.