It's not necessarily JavaScript that they check for, as some legitimate users do indeed have JS disabled. It's moreso checking for footprints, eg if you're under a HTTP flood you may see a lot of requests like this:
GET /forum/ HTTP/1.1
Host: osbot.org
User-Agent: Opera 9.0
Accept: */*;text/plain;text/html;application/json
Now, if you see 1000 requests similar to this every second (with different IPs), you know they are all there for the same intent which is to take the site down.
There is also another type of flood, called Slowloris, which utilises open HTTP POST connections to flood the server.
A request for that may look like this:
POST /forum/ HTTP/1.1
Host: osbot.org
User-Agent: Opera 9.0
Content-Length: 999999999999999999
(at this point, the request is open and the server is receiving all the data until it reaches length 999999999999999999, which the end user exploits)
If a request like that happens, then it's likely an attacker.