In reply to Ryan Hellyer.

Well, I guess honeypots are the simplest form of detecting a bot, so there might be bots intelligent enough to evade the honeypot. But on the other hand, you can disguise a honeypot so that it would be too hard find or too time intensive to code more intelligence into the bot.

I admit that on some sites a honeypot is not sufficient. I don't know what factors it really depends on, but last year I had a few days with about 1k bot attacks and 3 to 5 human attacks on the same day. All bots were cought by my private implementation of honeypots, only disguised with CSS in the style.css file and a text input named vstt_email. Of course, this cannot be representative because it's only one site using vstt_email. With an increasing number of sites, some bots might learn to skip that field and quickly we are at the 99.99% you mentioned.

I hope that makes any sense :)