Title: TLDR: I help with a gaming community-related site that is being targetted by a script kiddie, they are registering hundreds of thousands of accounts on our forums to &#x27;protest&#x27; a cheating (aimbot) ban. They then post large ASCII art spam, giant shock images (the first one started after we blocked new accounts from posting [img]), the usual.<p>Currently we use a simple question&#x2F;answer addon at registration time - it works against all untargeted bots and is just a little &quot;what is 4 plus six&quot; or &quot;what is the abbreviation for this website&quot; type of question. It&#x27;s worked fine for years and we don&#x27;t really get general untargeted spam.<p>I am somewhat ethically disinclined to use reCAPTCHA, and there are some older members that can&#x27;t reasonably solve hcaptcha easily. Same for using heavy fingerprinting or other privacy invading methods. It&#x27;s also donation-run, so enterprise services that would block something like this (such as Distil) are both out of budget and out of ethics.<p>Is there a way I can possibly solve this? Negotiation is not really an option on the table, the last time one of the other volunteers responded at all we got a ~150Gbps volumetric attack.<p>I&#x27;ve tried some basic things, like requiring cookie and JS support via middleware; they moved from a Java HTTP-library script to some kind of Selenium equivalent afterward. They also use a massive amount of proxies, largely compromised machines being sold for abuse.
Upvote: