Hi all!
So, how can i see, bots is the really zaebali (sorry for my french).
I had used antibot script and .htaccess.
My ban list you can see in
http://octopus.pp.ua/BAN.txt . It consist proxies and TOR's IP's. Manually checked every day, when i had attacked by bots. Yes, i'm nerd

And antibot script. I had set timeout in "Get reward" button in 60 sec, and set coockies with time of impression from user. When user click to "Get reward" button, i have check, is 60 sec out. So, when bots attack again, i will change that to save it in session.
If you want, you can use my experience.
1. Open your index file and add in first
setcookie("Mortal",$_SERVER['REMOTE_ADDR'], time()+3000);
setcookie("Combat",time(), time()+3000);
"Mortal" saved current ip of user
"Combat" saved current time of visit
2. In "POST" section add:
if (($_COOKIE['Mortal'] != getIP()) or ((time() - $_COOKIE['Combat']) < 50))
{
banned();
}
Where function banned(); is
function banned() {
trigger_error("Banned: ".getIP());
http_response_code(403);
die();
}
So, with that code and .htaccess i defence my faucets.
Good luck!