My faucet is new and I get a handful, sometimes even none, payouts per day. These 700 where only in 1.5 days. The ref address was discussed in another thread here on the forums as suspicious as well.

But you are right, on a normal working mature faucet, what is suspicious and what is real? But I think faucet owners probably notice patterns which are odd. For me it was that all addresses had an auto payout limit of 0.5 bitcoins. 700 addresses with the same ref address and 0.5 auto payout address is a pattern.... ;-)

Anyway, it was a good lessons as well. I added proxy checks, IP checks, updates my ban lists, etc. So it was not a waste of time. In the mean time I learned some of the FIB coding as well.

I'm just wondering, do faucet owners "babysit" their faucets? Is it a constant watch and fight against bots/scammers? I probably know the answer seeing so much 'double your btc' and the likes.