This is why Microsoft's requirement to drink a verification can was so genius. Imagine being a hacker and have to drink multiple verification cans to be able to proceed throughout multiple transactions. "Hacker dies from overdose due to ingestion of too much Doritos and Mountain Dew"
Wait, so you're telling me that Cloudflare interstitial is running some PoW check on my client? I always thought that was just a way to let the user know they're being rate limited on Cloudflare's end.
Effectively yes. Not mining bitcoin, but modern bot detection works by asking your browser to do various tasks and comparing the results to a known good sample.
It could be a complex math problem, or another common trick is to purposely trigger bugs like a javascript engine not rounding numbers correctly in edge cases.
https://imgur.com/dgGvgKF