如果这个答案已经提交，请原谅。有很多答案，要试着去阅读和理解所有的答案。

为什么不能每隔一段时间就改变一下购买API呢?难道这对人类用户来说不是完全透明的，并几乎杀死了大多数机器人购买者吗?

一种实现方法是更改用户在点击“I Want One”按钮后必须填写并提交的字段名称。你一年卖出多少次中行?不经常。因此，每次BOC发售时，编写、测试和准备使用不同的采购API不会是一个巨大的编程负担。

只要确保使用旧的和不正确的API的机器人不会使您的服务器瘫痪。每次也可以在不同的服务器上托管BOC购买API。这样，机器人就可以关闭一个服务器，而我们人类BOC购买者实际上并没有使用它。

以下是我的看法。攻击机器人所有者的投资回报率，这样他们就会做你想让他们做的合法事情，而不是欺骗。让我们从他们的角度来看。他们的资产是什么?显然，无数的一次性机器、IP地址，甚至可能还有大量不熟练的人愿意做无聊的工作。他们想要什么?总是在其他合法的人得到它之前得到你提供的特别交易。

The good news is that they only have a limited window of time in which to win the race. And what I don't think they have is an unlimited number of smart people who are on call to reverse engineer your site at the moment you unleash a deal. So if you can make them jump through a specific hoop that is hard for them to figure out, but automatic for your legitimate customers (they won't even know it's there), you can delay their efforts just enough that they get beat by the massive number of real people who are just dying to get your hot deal.

The first step is to make your notion of authentication non-binary, by which I mean that, for any given user, you have a probability assigned to them that they are a real person or a bot. You can use a number of hints to build up this probability, many of which have been discussed already on this thread: suspicious rate activity, IP addresses, foreign country geolocation, cookies, etc. My favorite is to just pay attention to the exact version of windows they are using. More importantly, you can give your long-term customers a clear way to authenticate with strong hints: by engaging with the site, making purchases, contributing to forums, etc. It's not required that you do those things, but if you do then you'll have a slight advantage when it comes time to see special deals.

Whenever you are called upon to make an authentication decision, use this probability to make the computer you're talking to do more-or-less work before you will give them what they want. For example, perhaps some javascript on your site requires the client to perform a computationally expensive task in the background, and only when that task completes will you let them know about the special deal. For a regular customer, this can be pretty quick and painless, but for a scammer it means they need a lot more computers to maintain constant coverage (since each computer has to do more work). Then you can use your probability score from above to increase the amount of work they have to do.

To make sure this delay doesn't cause any fairness problems, I'd recommend making it be some kind of encryption task that includes the current time of day from the person's computer. Since the scammer doesn't know what time the deal will start, he can't just make something up, he has to use something close to the real time of day (you can ignore any requests that claim to come in before the deal started). Then you can use these times to adjust the first-come-first-served rule, without the real people ever having to know anything about it.

The last idea is to change the algorithm required to generate the work whenever you post a new deal (and at random other times). Every time you do that, normal humans will be unaffected, but bots will stop working. They'll have to get a human to get to work on the reverse-engineering, which hopefully will take longer than your deal window. Even better is if you never tell them if they submitted the right result, so that they don't get any kind of alert that they are doing things wrong. To defeat this solution, they will have to actually automate a real browser (or at least a real javascript interpreter) and then you are really jacking up the cost of scamming. Plus, with a real browser, you can do tricks like those suggested elsewhere in this thread like timing the keystrokes of each entry and looking for other suspicious behaviors.

So for anyone who you know you've seen before (a common IP, session, cookie, etc) you have a way to make each request a little more expensive. That means the scammers will want to always present you with your hardest case - a brand-new computer/browser/IP combo that you've never seen before. But by putting some extra work into being able to even know if they have the bot working right, you force them to waste a lot of these precious resources. Although they may really have an infinite number, generating them is not without cost, and again you are driving up the cost part of their ROI equation. Eventually, it'll be more profitable for them to just do what you want :)

希望这对你们有帮助，

Eric

Restrict the times at which you release offers: For example: only from 7 minutes to 8 minutes past the start of an hour. Do not deviate from this, and give penalties on the order of a couple seconds to IPs which check a lot in the half hour before the release time. It then becomes advantageous for bot owners to only screen scrape for a couple minutes every hour instead of all. the. time. Also, because a normal person can check a site once every hour but not every second, you put normal people on a much more even footing with the bots.

饼干: 使用仅由唯一ID(数据库表的键)组成的跟踪cookie。对没有cookie的客户端、无效cookie、使用新IP的相同cookie的客户端或频繁使用cookie的客户端给予“发布延迟”。

识别可能的机器人: cookie将导致机器人为它们控制的每个IP请求多个cookie，这是可以跟踪的行为。只有一个发出的cookie的ip很可能是普通的客户端。有许多发出cookie的ip要么是大型NAT-ed网络，要么是一个机器人。我不知道你会如何区分这些，但公司可能更有可能拥有DNS服务器、网页之类的东西。

我只是想知道有没有简单的解决办法。

我假设表明垃圾销售的消息是通过文本发布的，这就是刮刮器寻找的信息。

如果你用图片来代替广告呢?这样做可能会带来一些设计问题，但它们可以被克服，并可能成为一些巧妙创意的动力。

问题# 1 必须有一些设计空间专门用于图像。(想耍点花招吗?通过这个插槽旋转一个本地广告。当然，图像的名称需要是静态的，以避免给刮刀的气味。这是一个永远不用担心广告盲目性的位置……)

问题# 2 RSS。我不确定是否每个人都可以在他们的提要阅读器中查看图像。如果有足够多的用户可以这样做，那么您可以开始发送包含图像的每日提要更新。你可以在大多数日子里发送任何你想要的杂七杂四的东西，然后根据需要将其切换为你的垃圾销售警报。

我不知道……他们会不会只是编程让他们的机器人在每次feed项目出去的时候都攻击你的网站?

其他问题吗?可能很多。也许这将有助于头脑风暴。

当心 布莱恩

为此目的，我使用Cloudflare，因为它不会影响我的网站，但会自动阻止任何恶意用户的验证码，并为您提供更多的功能。

根据您想要进入的复杂程度，您可以采取一些解决方案。

这些都是基于IP跟踪，在僵尸网络和云计算下有些崩溃，但应该能挫败绝大多数的僵尸。乔·兰登拥有大量机器人的可能性远远低于他只是运行一个从某处下载的Woot机器人来获取他的垃圾的可能性。

普通的节流

At a very basic, crude level, you could throttle requests per IP per time period. Do some analysis and determine that a legitimate user will access the site no more than X times per hour. Cap requests per IP per hour at that number, and bots will have to drastically reduce their polling frequency, or they'll lock themselves out for the next 58 minutes and be completely blind. That doesn't address the bot problem by itself, but it does reduce load, and increases the chance that legitimate users will have a shot at the item.

自适应调节

An variant on that solution might be to implement a load balancing queue, where the number of requests that one has made recently counts against your position in the queue. That is, if you keep slamming the site, your requests become lower priority. In a high-traffic situation like the bag of crap sales, this would give legitimate users an advantage over the bots in that they would have a higher connection priority, and would be getting pages back more quickly, while the bots continue to wait and wait until traffic dies down enough that their number comes up.

废料验证码

Third, while you don't want to bother with captchas, a captcha at the very end of the process, right before the transaction is completed, may not be a bad idea. At that point, people have committed to the sale, and are likely to go through with it even with the mild added annoyance. It prevents bots from completing the sale, which means that at a minimum all they can do is hammer your site to try to alert a human about the sale as quickly as possible. That doesn't solve the problem, but it does mean that the humans have a far, far better chance of obtaining sales than the bots do currently. It's not a solution, but it's an improvement.

以上的组合

实施基本的、慷慨的限制来阻止最滥用的机器人，同时考虑到单个公司IP背后的多个合法用户的潜力。截止数字将非常高——你引用了bot攻击你的网站10次/秒，即216万次/小时，这显然远远高于任何合法的使用量，即使是最大的公司网络或共享ip。

实现负载平衡队列，这样如果占用的服务器连接和带宽超过自己的份额，就会受到惩罚。这将惩罚共享公司池中的人，但不会阻止他们使用站点，而且他们的违规行为应该远没有您的装瓶者那么可怕，因此他们的惩罚应该不那么严重。

最后，如果您超过了每小时请求的某个阈值(这个阈值可能远远低于“自动断开连接”的截止值)，那么就要求用户使用验证码进行验证。

这样，合法使用网站的用户每小时只有84个请求，即使他们非常兴奋，也不会注意到网站速度变慢了。然而，乔·波特发现自己陷入了两难境地。他可以:

Blow out his request quota with his current behavior and not be able to access the site at all, or Request just enough to not blow the request quota, which gives him realtime information at lower traffic levels, but causes him to have massive delays between requests during high-traffic times, which severely compromises his ability to complete a sale before inventory is exhausted, or Request more than the average user and end up getting stuck behind a captcha, or Request no more than the average user, and thus have no advantage over the average user.

只有滥用的用户才会受到服务降级或复杂性增加的影响。合法用户不会注意到任何变化，除了他们更容易购买他们的垃圾包。

齿顶高

以远低于注册用户的速率限制未注册用户的请求。这样，机器人所有者就必须通过一个经过身份验证的帐户来运行机器人，以通过应该是相对严格的节流率。

然后，有创造力的装瓶者将注册多个用户id，并使用这些id来实现他们想要的查询率;您可以通过将给定时间段内来自同一IP的任何ID视为相同的ID，并接受共享节流来解决这个问题。

这使得装瓶商别无选择，只能运行一个机器人网络，每个IP一个机器人，每个机器人注册一个Woot账户。不幸的是，这实际上无法与大量未关联的合法用户区分开来。

您可以将此策略与上述一种或多种策略结合使用，目的是为没有滥用使用模式的注册用户提供最佳服务，同时根据他们的状态(匿名或已注册)以及由流量指标决定的滥用程度逐步惩罚其他用户，包括注册用户和未注册用户。