After stopped and cleaned the WordPress pingback and trackback spams, those spammers change strategy to start spamming comments on the post attachments.

Solution

Here is the PHP script to disable comments on attahments, apply it on the theme function.php

${theme_folder}/function.php

//disable comments on attachment
function filter_media_comment_status( $open, $post_id ) {

    $post = get_post( $post_id );
    if( $post->post_type == 'attachment' ) {
        return false;
    }
    return $open;

}
add_filter('comments_open', 'filter_media_comment_status', 10 , 2 );

The attachment comments will indicated as trackback comments. To clean up the wp_comments table, delete all comments where comment_type = trackback


DELETE FROM  `wp_comments` WHERE  `comment_type` =  'trackback'
Note
WordPress should really consider turning off the pingback and trackback features by default, it is attracting many spammers and add less value to the WordPress platform. Btw, who is using trackback?