sanscript: In certain ranges/countries CAPTCHA is easily and fastly finished if it even comes, other times it's like a carnival carousel that never ends. I wouldn't be surprised if it triggers more often if the IP is known to have "unusual" high activity.
Indeed, plus, I suspect it also relates to ongoing activity. Even without further analysis, if the IP region you're using currently is attacking the site you're trying to visit, these attacks alone might just be fast enough to invalidate your successfully solved Captcha before you get to the next step, so it just keeps going round.
honglath: 1. There's supposedly a kind of intermediary that analyzes traffic and decides how suspicious or unreliable an ip range is, then can blacklist it for their clients or just make its life miserable.
Indeed. Most will tell you you're blocked but provide no option to unblock, unlike Captchas do. Others outright lie to you about the page not being found (fake a 404) or overloaded (GOG doesn not do that on the store, but does this with the forum; notably, even if you successfully logged in with 2FA in many cases), or just don't respond at all and leave you to time out without even knowing it's happening. That's the worst and most shameful IMO, because it harms the legitimate users more than the adversaries.
honglath: I've read that major companies use this intermediary to automate their protection against spam, bots, ddos, hackers etc. But i'm not sure how reliable this info is. I read it in forum post where a small time company owner complained being extorted by this kind of intermediary in order to remove their mailing server from such a blacklist as his company's emails could not reach his partners.
Yes, there is, Cloudflare being the most widely used one, but there are at least two others whose names I don't recall ATM.
timppu: GOG triggered 2FA verification, but no CAPTCHA.
2FA seems to disable Captchas, which makes sense because it serves the same purpose, only better. So in order to test this, you would first need to disable 2FA for your account. Logging out (which I always do after use) triggers 2FA every time I try to relog, which is understandable and OK given my setup, I wouldn't expect anything less in fact.
randomuser.833: Aka many different machines try to access GoG from a single IP or from an IP that has been flagged as bad by some technical provider of GoG. So it could be some larger internal network people are inside first, too.
If nothing of this is used, it is because the ISP is doing some nasty stuff behind the lines.
And it seems to happen a lot with US ISPs. At last if I thrust that people tell us their real location.
I suspect that CGNAT might trigger this, because it does exactly that: mask potentially thousands of users behind a single IP. And with the IPv4 exhaustion and smaller ISPs springing up everywhere, this might become more common.