Ask IH: Malicious bot protection?
I open this thread for me and those who seek a method to prevent malicious bots to generate spam.This is not only for user generated content but for basic input forms also (Sign Up-pages) .
Tokens are great to prevent CSRF but not for local bots.
Do you use google reCAPTCHA, you rely on your framework protection or you made a custom one?
Try the honeypot technique. Google reCAPTCHA is pretty common for sign up pages, but I would only use that if nothing else works.