I always ban IPs. If they are bots, they are highly unlikely to be real visitors too sharing those ip addresses. Ban the IPs temporarily, say, a month, and put

I always ban IPs. If they are bots, they are highly unlikely to be real visitors too sharing those ip addresses. Ban the IPs temporarily, say, a month, and put a message in your '403 forbidden access error page' saying sorry: "your ip is blocked because of weird-things-happening-from-your-ip, if you are a customer you should check for trojans or virus on your computer and send us an email"