The day we turned on our CAPTCHA, I also remember being horrified at the number of people likely running LimeWire on US Navy vessels. One IP address in the DC

The day we turned on our CAPTCHA, I also remember being horrified at the number of people likely running LimeWire on US Navy vessels. One IP address in the DC metro area had multiple purchases per minute, with half of the email addresses ending in .navy.mil, so I added an IP address whitelist to not drop those CAPTCHA answers into the replay-prevention cache. I'm pretty sure that IP address was the base station for a US Navy satellite. I mean, not horrified enough to prevent them from paying my company $18.88, but still horrified. In retrospect, given that we were a 13 person company selling software with a marginal cost near zero, we should have left the system in place and never processed the $1 charges. Instead, we should have used a CRC32 of the upper-cased name and credit card number (in case they verified consistency) to accept 98% of $1 purchases without ever charging any of the cards. Even better would be to do a 2-part credit card transaction, first placing a hold on the credit card for the full purchase price, and waiting one minute to see how many different credit card numbers came from the same IP address in the next minute. If less than 4 different numbers came in the past minute, go ahead and complete those transactions, otherwise put the IP on the hellban list to start getting randomized results. Injecting pure noise into the carding ecosystem would have cost us nearly nothing (and given a 100% discount to a bunch of active duty sailors).