Sadly, I'm not familiar with lots of securities. I've heard about that form trick and I'm kicking myself for forgetting about it and not mentioning it; however,

Sadly, I'm not familiar with lots of securities. I've heard about that form trick and I'm kicking myself for forgetting about it and not mentioning it; however, you already knew so no harm there =p Yeah. Captcha is an idea that I would have mentioned, but my ideas for captchas are insane. When I start talking about all of the little things I want to do I start sounding ridiculous. But I definitely suggest putting a basic one on all of your forms. It's quite simple to make actually. Php provites all of the necessary "image creation" functions you would need. Indeed. However, a smart bot will still not fill in a form box with display off. My solution is to provide a blank form and literally telling the user "If you fill out this box, then the submission of this form will be ignored" or something of the like. Of course this wont stop bots which have been fine tuned to "attack" your site. Okay. I'll stop ranting. I just love talking about the subject. The scale of the operation really is daunting. Sadly without setting up subtle things all over the place and then scrutinizing the data, it becomes hard to do anything at all. BTW that is a LOT of IP addresses. How many of those are actually confirmed bots? As for proving google wrong. It would be very difficult. I'd love to help if I could haha. I'll throw out a couple of ideas that come to mind seeing as I'm talking about one of my favorite topics and well...you can't possibly stop me! You can detect the site from which they just came from. If you can confirm the bot (Yeah. Hard part, but someday if someone doesn't do it first- I'll make the software necessary myself -and of course make it free. Open sourcing it would be a tricky issue because then the enemy can read it! I don't like making a smarter enemy.) and put that together with the site, you can investigate where the clicks are coming from. If they are coming from several sites with google ad sense or whatever, well. That can turn out to be pretty compelling evidence. (odds are) Furthermore, a lot of those IP addresses will be from Asia. Pretty compelling evidence. K. That was racist- but also a statistically proven fact =/. When you stack up similarities, like maybe even browsing time on your site- you may be surprised at the quality of the argument you can make. I mean. I am assuming the attackers aren't like me. If I were an attacker I would spend weeks forming the software so that I weren't bested by someone like me. But hey. No body is perfect. Find similarities. Get your money back! RAWR