[raquo]

Try a honeypot maybe - create an invisible link and see if it gets visited. If their bots are dumb enough to visit the privacy page then they may fall for this too.

In general looking into anomalies in GA is a good bet - find differences in not-so-important metrics like browser shares, countries, network names, screen sizes, time-of-day, etc. you should find enough data to at least convince yourself. It's hard to fake everything properly.

Try actually looking at server access logs and see if you notice any patterns - UAs (phantomjs?), IPs, ...

[einehexe]

Thank you raquo that worked like a charm. We now have them dead to rights. I will do a write up for HN at some point when everything is resolved. Simple and effective solution, thanks again.

[raquo]

Heh, awesome that it actually worked!