Serve the suspected bots a page with Javascript that computes a proof of work, submits it, and gets the real page in return. Steamspy.com seems to trigger one

Serve the suspected bots a page with Javascript that computes a proof of work, submits it, and gets the real page in return. Steamspy.com seems to trigger one of these basically every time when loaded with a fresh cookie.