Ban IPs. If they are largely coming from a country you are not marketing in, consider blocking off that country as a "stop the bleeding" measure. See what othe

Ban IPs. If they are largely coming from a country you are not marketing in, consider blocking off that country as a "stop the bleeding" measure. See what other patterns you find and ban IPs based on those. Edit: I also remember people putting in fake fields that are not visible to the user. If they have any value in the form submission they are scripts and can be rejected.