Non tech solution

What I do is to run two groups, registered and qualified

Put people in the qualified group after five posts and at that point they are unmodified.

I used to moderate their posts and comments but as time went by found it was possible just to mod. comments.

The (active) membership is not huge so it's no hardship to change someones account when they draw attention by contributing although no doubt this could be hacked.

As the site is TG support I used to have a LOT of trouble with trolls registering just to see the (imagined) goodies inside. So site is also set up so new members see no more of the forums etc. when logged in than they can see logged out.

In particular they can't get at users profiles till they "qualify" which I assume is what they mostly want.

Under this system they seem to just get bored and drift off, we cull the inactive accounts periodically.

This approach evolved over our first year and came out of thinking through why the buggers were doing it, the details would vary with type of site I guess but basically you need to de motivate them if you can, bore them.

I searched this thread out because the latest game is someone from a Ukranean ISP posting porno links in the news comments system (not logged in so not a prob really as all such comments are modded, so all he is doing is giving us a nice list of IPs). Mainly I was more curious to learn more about how XOOPS handles (block/range) IP banning.

I mailed their abuse contact and they never answered plus the mystery visitor still drops by once a week to post, lol. So as I know I have no members from their network I was tempted to ban them totally for a bit just to let em know I can.

This is like a race against cancer. We know how bad it is, we can control it. But a SOLUTION! by the time you find any, they have are immune.
The few who are engage in such activities, are most probably advanced internet users.- they are determine to make your task even more difficult.

Then comes the time to ask oneself a few questions.

If your site is not a site with many new daily registrations.
Do I open my site for registration by email or do I set registration to be approve by moderators first?(if I have the option)
What do I get or loose if I allow AVATARS upload?
And when I am surfing on the internet, -do I submit my website to any unknown website that claim to be a web portal.
There are thousand of these website around asking you to submit your link, they are even claiming to have 20millions hits monthly , They can send you 50,000 hits daily. Yeah the fakes hits!

My site is selling cars in UK or In France. Or My site is providing a service to internet users in Argentina only;
do I need to submit my website to an Asian portal?
Can I have in my .htacces to deny all users from Asia. I don't need users/visitors from Asia or from Australia or vice versa .

other example: The service I am providing is selling dogs. Why should I submit my website to place where they are selling pharmatical stuffs. These are just few things to take into consideration when running a website and you probably know.

But what method these advance users are employing to spam your site successfully?!
The silent surf! (many of you should know that) To surf silently you dont even need to be a crazy hacker or the best programer. Anyone can use it without any speciale knowledge.

The advanced users and they have done their homework before they came to drive you crazy daily.
They are using ' proxy'. They can never be traced down. You'll hit a dead end.
The datas they are submitting or retrieving from or to your website are bouncing in-between computers encrypted or maybe thru.. some old boxes with full of viruses in Asia somewhere.
The proxy system and onion system hides their identity and they may never be caught.

This system is used a lot to spy on your competition or for other sort of investigation or by dissident. Unfortunately some clever ones uses it for porno stuffs and illegal activities.
With the proxy, they are probably next door to you or even greeting you good morning everyday! but the IP DNS or what ever will show that the users is a thousands miles away. And every time, the very same user will be some where else.

How can you catch such a malicious person or ban that kind of person from your entering your site?
Virtually impossibility? take the ip or rage of IP and ban.- that is okay.

- But take for one moment, if I don't need users from one particular country, maybe best way is it to consider to deny the whole country from entering your site.
- No, there is no point to submit a website to just any portal that is asking for your link.

So what are really the precaution to take to reduce their activities and damage? Finding a remedyis difficult, but try reduce the damage.
note:
#1.Always have a good webanalyser.
#2. These are not remedies, but just some o fmy personal thoughts, and things that came down my way in yesteryears.

Well the porno link posting actually increased after my mail to the abuse contact so I banned their entire IP allocation.

So far so good fingers Xed

I don't know if this would help but you might like to read:

https://xoops.org/modules/newbb/viewtopic.php?topic_id=51906&forum=20&post_id=229220#forumpost229220