Stopping SpamBots

Neil Gunton’s journals his fight against spambots on his web site. Initially he started with the obvious ones such as User-Agents, then he moved on to behaviorial ones, like honeypot baits and unusual browsing behavior. Eventually he started using IP-based blocks.

Much better would be to

1) permit users to comment
2) log IP addresses
3) provide a report-spam button for casual visitors
4) submit report-spam data (IP address and date-time) to centralized service
5) this alone does not trigger any spam clean up, instead result in text being collapsed (like comment below threshold on slashdot),
6) centralized service can then apply IP address reputation points
5) apply centralized service’s reputation points to all existing comments

False positives may arise if users posts comments routed through Tor servers. It’s left as a matter of website owner policy (e.g. value of time to sort out spam vs value of information posted).

Any thoughts?