From what I can see it sends now a POST request after the GET request of the userlookup with the following data:
user: username_of_the_userlookup
randomfriend: same_as_above
g-captcha_respose: lorem_ipsum
most probably they're triggering the google captcha in the background and sending the response again to the server... haven't check tbh.
EDIT:
Code:
<script src="https://www.google.com/recaptcha/api.js?hl=en" async defer></script>
<script>
function onSubmitRCI(token) {
document.getElementById("formULRCI").submit();
}
</script>
<p>Our meepits are diligently (or so they say) working to connect you to your page...</p> <style type="text/css">
body {
margin: 1em 5em 0 5em;
font-family: sans-serif;
}
fieldset {
display: inline;
padding: 1em;
}
.grecaptcha-badge {
display: none;
}
</style>
<script>
$( window ).load(function() {
grecaptcha.execute();
});
</script>
<form id="formULRCI" action="/userlookup.phtml?user=" method="post">
<input type="hidden" name="user" value="">
<input type="hidden" name="randomfriend" value="">
<div id="recaptcha" class="g-recaptcha" data-sitekey="key" data-callback="onSubmitRCI" data-size="invisible"></div>
</form>
<br clear="all">
Confirmed.