One of the greatest threats that massive multiplayer online games (MMOGs) face today is botting, a form of cheating in which a player uses a script to automate actions in a game without actually playing. This has a severe adverse effect on honest players and impacts their motivation to continue the game, threatening online game providers' subscription-based business model. However, if game companies make an effort at all to automatically detect bots, it's usually through signature checking for suspicious programs on the client side, essentially relying on information from an untrusted source beyond their control. To address the problem, we propose an automated approach to detect bots on the server side, solely based on character activity. Our approach is completely transparent to the end user and exploits the fact that bots follow a script that guides them through the virtual world. More precisely, by analyzing a character's movement data, we can extract waypoints and detect repeated paths. This allows us to find movement patterns that appear frequently, indicating that a character is controlled by a script and not a human player.