Yup, you've got the right idea.<p>I've managed to figure out a few peculiar things the bots do while crawling combined with the fact that they seem to only use one of a handful of legit, but very specific user agents. I've got some mod_security rules + a script that combs logs and passes the IP to an iptables script to block them. Are you familiar with mod_security? The default rules are a little too aggressive for my liking, but it's a really fantastic tool.<p>Adding a CAPTCHA to all forms would be an easy solution, but it's just not practical on many of our forms. I've had a good deal of success adding a hidden form field (that is, one that's set to display:none by a CSS rule) and then ensuring that it hasn't been tampered with when the form is submitted.<p>The gibberish is typically random letters and numbers, but it's smart enough to fill all numbers in fields expecting phone numbers and email addresses in fields expecting emails.<p>The scale of the operation is daunting, though. My script is pretty conservative (I really don't want to block legit usrs) and it still picks up a few hundred new IP addresses every day. I expire the bans after a week or the list would get unmanagable.<p>And dealing with Google is very frustrating. Google says they've already detected all fraudulent clicks and credited us. I think they're wrong, but I don't see how I could possibly prove it.