You should have some record of the users who have purchased BOC most often, why not just ban those accounts or something. Sure legit users will be banned in this process but you are a business providing a product and if your are being abused by a group of users and such you have the right to refuse service to them. You have a lot of info on your users including paypal and bank accounts, you could ban those accounts forcing the bot users to get new accounts. Certainly I could come up with a script to buy BOC all the time or just download one from the net, but I have better morals than that. Never actually having successfully purchased BOC, I know the frustration of legit users who would like to receive a BOC in the hopes of getting a great deal. Perhaps instead of offering a BOC as an individual item every once and awhile, you could just give it to random users every day. When they receive an item they get a little note and and an additional item saying they also received a BOC. Then the only way someone could get a BOC is if they legitimately purchased something that only an actual human would have wanted. There would be nothing better than purchasing a coffee maker or something and also receiving a 42" tv or something in addition to your legitimate purchase. I think the majority of script kiddies would no longer be interested in your site if in order to get a BOC they would also have to commit to a purchase of more than 10 dollars.

As for CAPTCHAing everyone, why not use the Google solution of only requiring CAPTCHAs from IPs you suspect as being bots, or even just users that hammer the site? I'm sure asking someone for a CAPTCHA when they purchase isn't so bad if they've been hammering the site anyway, its just about the same as staying up and hitting F5 repeatedly. That or maybe require a periodic CAPTCHA when hammering, say every hundred (maybe smaller?) or so refreshes, to stop alarm-bots from working. You need some sort of CAPTCHA to prevent botting, but you also need to account for the fact that your real users will act like bots.

想出一种识别机器人的方法如何，可能是基于IP，但不阻止他们访问网站，只是不允许他们实际购买任何东西。也就是说，如果他们买了，他们实际上并没有得到它，因为机器人违反了使用条款。

我不明白为什么IP地址过滤必须是非常昂贵的。使用IIS，您可以构建一个ISAPI过滤器来在本机代码中执行此操作。我相信apache也有类似的接口。使用客户端的IP地址，您可以为HTTP请求编写一个简单的速率限制器，它不依赖于禁止列表或其他类似的废话。

通过服务器上的iptables(如果是基于Linux的)或使用专用的“路由器”来限制每个IP地址的并发连接

作为Woot.com的长期用户(4年)和几袋垃圾的购买者，在我的车库中有许多其他的物品，似乎解决方案应该是Woot整体主题的一部分。

使用验证码，但要幽默。就像100万美元的促销一样，你也可以将自己当成一个人来做游戏。在过去，这使得中行的“售罄”推迟了一段合理的时间，而像我这样的人，则争先恐后地想出一个相当简单但幽默的谜题，输入优惠券代码。

此外，虽然人们不断抱怨服务器错误，但他们不会停止返回。在我看来，购买中行之所以令人兴奋，部分原因在于有无数人都想买。如果服务器抛出一个错误，或者一个奇怪的页面，这表明我是一群试图获得1500个产品中的一个的太多人中的一个。

如果你在构建谜题上投入了足够多的创造力，并且它足够新颖，它就会拖延机器人足够长的时间，给其他人一个机会。在“我想要一个”和购买页面之间放置一个临时页面，这需要一些独特的人类互动，你已经阻止了机器人，直到它们弄清楚需要发生什么。

• You haven't implemented a boring, and sometimes painfully difficult to read captcha • you've made the process more fun, • you've reduced the load on the actual secure purchase server • You'll train the users that they will need to "DO" something to get a BOC • You'll stopped the bots at the interim page, delaying their purchases until most people have at least had a chance to try and figure out the funny, but not terribly difficult puzzle. • Since being random is what a BOC is all about, a random, and changing puzzle/task would fit in simply with the whole pitch of a BOC.

随着试验的进行，临时页面背后的技术可能会变得更加先进，可以捕获用于购买页面的随机信息。自

自05年5月31日以来，我已经购买了7个BOC，没有机器人的帮助，也没有任何脚本，除了wootalyzer，我觉得这是一个可以接受的帮助。最好的一个，我没有得到，是Please Please Me BOC。B&D电池也很有趣，但我猜它并没有难倒机器人，只是让普通用户感到沮丧。

有时候，技术问题的最佳解决方案并不是更多的技术。