dstiles - 9:34 pm on Jul 8, 2011 (gmt 0)
Join the "Search Engine Spider and User Agent Identification" forum and read the past year (at least) very carefully.
In essence, though: block all server farms (including google, ms etc apart from obvious bots such as googlebot/bingbot); detect and block all botnets (tricky but mostly possible); accept only known good user-agents.
Every time you block a range of IPs some other idiots get infected and taken over by botnet owners. You can never keep up by simply blocking botnet IPs.
Other than that, links, reviews etc, even from google, are of no use: panda is a killer. So is google apps.