IT Networking question about spam

From a none expert point of view ..if the IP address of an attacker is known, blocking it is easy - such as entering the IP into your router list of blocked IP address. However, most attackers' IP address will not be fixed or known - otherwise the attacker will be revealing it/themselves and can be reported easily.

So, the website server needs some sort of load balancing or some logic to guess if a particular hit is a robot / attacker and either delays or kill it. Then most attacker will probably design it's attack to look like a regular user request to make it hard for the server logic to guess if it's being attacked..