How do you tell if it's a bot? Just by user-agent string or repeated slamming by IP address, or is there some other technique? A combination of things. Off the

How do you tell if it's a bot? Just by user-agent string or repeated slamming by IP address, or is there some other technique? A combination of things. Off the top of my head: * IP address ranges. Are they all from, e.g., EC2 instances? * Are images and other content (e.g. CSS) linked from the page loaded? How long does the client take to do so? Are other pages being viewed in line with what you've seen from other users? * What combinations of user agents are you seeing? * What's in the headers being sent by the browser? Any foreign language support, or oddities when it comes to not accepting compressed content? Is the referer header always the same? Does it always vary? * Do you see "normal" user behaviour that indicates activity such as clicking the back button, then clicking the ad again a few seconds later once their brain has kicked in? (nb: not sure if this is possible for Facebook with the way their site works). * Are there any patterns in the page access times? Is there anything to indicate a cron job is kicking off once an hour at the same time?