[locrelite]

Just a brief note: bot sophistication is off the hook. I worked at an ad network where one of the clients demanded we prove that the mouse had moved prior to "clicking" on one of their ads. No problem, we said, and most of the traffic passed the test. The traffic had referrers, legit user agents, javascript, and they were triggering the mousemove and click events. Out of curiosity, we sent a fraction of traffic to a test page, wherein the actual page was displayed in a full window iframe, then blocked access until the user clicked, and tracked their mouse movements. Easy enough; annoying for a user, but not a deal breaker for most.

The user movement maps we ended up with were straight lines of randomly spaced dots with sudden acute corners. A human could not replicate the pattern with a ruler and a pen pad, and we certainly didn't expect 90% of our human users going for that client's sites to be sitting around with rulers and pen pads drawing lines of randomly spaced dots. We checked the testing code and ran a dozen tests, and we couldn't figure out how a human could replicate it on any browsing device. Our conclusion is that somebody bothered to program a bot that would replicate mouse movement and we accidentally broke it by blocking programmatic access to the page, so it couldn't find a link to click and went crazy.