That majority came from you. It is not a fact. It is a factoide 
Most of malicious purposes are made from light web. Right now I have two users online, but there is 20’ish knockers trying to find holes. Actually banning countries helps more than banning onions.
But there isn’t still too much to do. You can ban every known tor entry point by hand, but if a server doesn’t inform it… There is no difference between VPN and Tor, and we don’t call VPNs as part of dark web.
But of course they are using tools that will hide indentity. What can you and we do then? USA, France, Germany, UK, China and Russia has tried close freedom of the net, without any luck because there is no big enough political and financial leverage. I don’t see how Discourse could do more.
Or they can. They can build up an AI that can identify malicious behaving. But let’s be realistic here — almost anything beyond watched words is scifi at the point.
But my weak point is banning IPs is just pure waste of time. It gives just illusion of security, nothing more. There must be some other tools but those options are bad and worse, because then we should start limiting all users somehow.
Trust level of Discourse is one solution and actually not bad at all. But there should be other metrics than likes (I just don’t get why bother counting likes, because then TL is a marketing tool, nothing else) or reads. What metrics? I don’t know.
If just one guy is after an admin/forum that situation is difficult — mostly because nothing else than IP bans there is not. All other knockers are easier, because majority of bots are stupid and badly coded. That’s why right now one vietnamise IP tries to expolit one ancient XMLRPC hole of WordPress at Discourse 
But most of apps and services are guiding to hide version. Not Discourse. Is it so because version sniffing is actully old story or is there some other reasons?