Botters may start 5 or more bots and leave them all day working. While playing any illuvium game randomly every 10 to 20 mins pops a captcha that requires human perception. If a supposed player is playing and the moment a captcha appears stops moving or is not able to solve it for a long time then it's not a player it's a bot. If you collect the time each player takes to solve captchas it's going to be very easy to spot bots. To avoid being spotted botters will have to be constantly watching their bot playing and stop it the same moment a captcha appears and to do so they may need to reduce the number of bots run at same time to just 1. Even so if they leave and captcha appears the bot may be spotted. This combined with detection of cheating software could be a good solution.
All crypto games do the same mistake that leads to their end. If new players put 100 into the game you spent 60 in game development and give 40 as revenue, then on the long term players are not going to even recover their investments. They invest to earn money not to lose it, so eventually will stop investing into the game and then the game dies with lots of people losing lots of money.
Illuvium needs to advertise products of other companies to be paid by other companies at least to not take investors money for development and paying organized competitions. To do this each time a captcha pops up, when solved you see 1 to 3 pictures that last 2 secs each picture, then a second captcha and when solved you continue playing. Or it could be 6 secs of video at most. Do not extend more the duration of ads or game experience will be bad. Do not sell player data for money. Don't insert links. Froze the game while captchas and ads time.
At this point the game needs to increase their player base. Not allowing VPN players to play will reduce it. Also people waited long and invested to play Illuvium, using a VPN is no reason to screw them now.