[rixed]

Of course users can fake server logs, since Referrer info is totally up to the client. Also, I'd argue it's harder to distinguish a bot from a real user from the server logs than from js.