[geolqued]

countermove: he works it out and blocks your magic query - query needs to be made from somewhere indistinguishable from normal requests. Changing IP would be best... maybe via tor.

A unique sequence of legitimate requests might be more difficult to for the other side to detect and it won't result in 404s. Could randomise the sequence and each can come from a different IP as long as they were synchronised properly.

[jarrett]

> countermove: he works it out and blocks your magic query

He very well might. But my estimation of the thief's skills is low. I could be wrong, of course.

> A unique sequence of legitimate requests might be more difficult to for the other side to detect and it won't result in 404s. Could randomise the sequence and each can come from a different IP as long as they were synchronised properly.

That's probably the best bet. A legitimate but very winding path through actual links on the site would work quite well. Given enough steps, it would almost certainly be unique. Because you'd be varying the path each time, the thief would find it hard or impossible to block you.