How to block a spammer?

Question

Fight against spam

One bastard on the site every day fills out a form on the site with inaccurate data. At first I blocked by ip, then I looked at the metrics webvisor and saw that it didn’t look like a bot. Everything looks human: opens the pages, goes to the form, fills it out. He does it manually, perhaps through the Tor browser or through some kind of vpn. I introduced a check for mouse movements, mouse clicks and keystrokes, but manual input is so ... By the time you spend on the site, you can see that everything fills up quickly, according to this criterion, there is no reason to send a letter to spam. What other "markers" are there, tricks, ways by which you can catch the messages of this guy and send them immediately to spam? Maybe something related to the fingerprint of the browser, but this is not strong. In general, what would you recommend?

PS
Captcha is not an option.

Answer 1

Firstly, you don't need to block him, just show him false notifications that the form has been submitted, let him rejoice. Secondly, you need to understand whether it cleans cookies every time you enter your site, because if not, then stupidly hang unique cookies on all visitors, and then, upon receiving spam, find which cookies these messages were sent from and blacklist these cookies list for false sending. Profit!
If the budget allows, then you can implement SMS identification in the feedback form, that is, until you enter your phone number and confirm it with a code from SMS, the form simply will not be sent. Very reliable.

Answer 2

If the project is regional, check the location. If outside your region / country, then complicate the procedure.

Answer 3

First blocked by ip

if IP blocking does not help, there is an option to calculate OS, Device (mobile/desktop), as well as browser and browser version. and so, most of all that your "friend" comes from the same device, and sends all this data. You can collect them, add them to the if, and if it's true - remove the type = "submit" button from the button, and in no case block it, he can continue to do this from the phone, let him think that he sent it, but the letters will not go to you.
In this case $_SERVER['HTTP_ACCEPT'] + google will help you