[Vince]

Use a GeoIP database. I use GeoLite from MaxMind (imported into MySQL). It contains CIDR IP ranges and their associated country. You can just outright ban any IP with country code 'A1', which stands for Anonymous Proxy. Some, but by no means all, VPN services also fall into this category. The ones that aren't in A1 will need to be manually blocked. You can use the CIDR range thread that's sticked in the Server Support section as a guideline.