Best Practices Recommendation - Bogus User Accounts

My cart has been public for less than a day and I am already getting bogus account registrations.
Looks like they're trying to overload the buffers with large character strings.
Is there a "Best Practices FAQ" to deal with bad actors like this?
IPs all over the place, countries all over the place - so blocking a country is not an option.
Windows IIS server (yeah, yeah, I know - Linux, but NO)
OC 3.0.3.6
URL: harbor-sales.com

Any and all recommendations cheerfully accepted

Your bogus account registrations are most likely caused by automated spambots visiting your website. Even most captchas are ineffective against spambots.

Our SpamBot Buster tool should help with preventing fake account registrations.

Or use reCaptcha