Most of the experienced spammers fake the referrer. They'll have a scrub site setup which will appear as any blog. The spammer will spam links to the blog page (often using a url shortener); however the link will contain a id. If you visit the page with the id it will selectively redirect traffic to their amazon affiliate link, without the id link it will appear as a normal blogpost.

Amazon will think the traffic comes from the blogpost. The person getting spammed won't get any protection if they filter amazon links.

All they'd have to do is add a captcha to the submit. Trivial to implement and it would reduce the spammers.

That might help for sites with a small userbase. However these are large platforms with large clusters of users that can be easily contacted. They'll just invest in a captcha cracking service which runs at about a 1000 solved captchas for $3. If you ban datacenter ips, use dnsbl and scan for proxies, they'll switch to rented dsl lines.

On the other end are the users. If you ban proxies, finger their ports and ask them to solve a captcha every time they hit the submit button; you'll create some serious animosity. Stopping spam means having to invest, come up with complicated algorithms and you still might accidentally ban innocent users who will blog about this or tell their friends [1].

The real question is... does it matter that affiliate links are being posted if it needs a guide to let the everyday users notice it [2]. My niece doesn't even know what a affiliate link is and neither do most users. I mean if there's a 100% method to stop it, implement it. However, should you invest money and dev time into problems that nobody has solved to this date...

[1] http://acme.com/updates/archive/173.html [2] http://www.dailydot.com/news/how-spot-spammer-pinterest/

manual captcha breaking services are available for as low as $10 for 1000 captcha breaks. Most of the bots use them, just pass the captcha image to the service and there is someone at the other end who would just enter the characters and all of these happens within seconds. search deathbycaptcha etc.

CAPTHCA is trivial to implement, but is terrible for usability.

And in many cases trivial to circumvent http://www.wausita.com/captcha/

Amazon Associates allows you to create unlimited, unique affiliate IDs, tied to one AA account.

Partly true, but they're not unlimited; there's a maximum of 100 per account, and once created they can't be deleted, so it's 100 lifetime.

How do you scale that? Sure, you found him - but how do you find the others?