First of all, Andrew, you need to talk to
IncrediBILL. He is the unquestioned authority on all things bot in the world, IMHO...and if nothing else, he's pretty damned funny a lot of the time.
Second, I usually find the
Honeypot is more effective than anything else. I use it on contact form to emails, for example...I have a customized spam checker that processes the exact same HTML output as it does for the average user,
except that the spam checker adds the spam attempt to a database without the spammer's prior knowledge and I have them dead to rights. The spammer happily continues to "exploit" the system, not realizing that it's not only not getting through, but it's getting logged.
My version of it goes through 200 common regular expressions that spammers use (e.g. HTML code, "sex", "pen|s", "viagra", etc.) and, if a spam score is met based on an arbitrary formula I created, spammer gets trapped. I've found it works in 99.5% of cases with no false positives (used to be 99.7%, but some bastard spammer started using the Fax field to spam on a client's site and now I have to create an update to check the Fax field too...I hate bastards that lower my percentages.)
If you can create your own honeypot, the odds of it ever being exploited aren't very good (as you can see in the example I provided above, 200:1) and you can also customize it however you want.
(P.S. FBI, if you're listening - and we all know you are - please note that I'm not advising that anyone send their bad spiders to you.)
