When a streetwear brand or toy manufacturer announces a limited drop, scalper bots arrive in force. Security Boulevard documented a ~70% reduction in fraudulent account takeovers when brands implemented IP-based inventory availability checks, blocking malicious requests that fired 500+ requests per IP in 30-minute windows. The mechanism: legitimate shoppers refresh the page a few times; bots hammer the endpoint hundreds of times, trying to secure cart holds before humans react.

The defense runs quietly at the infrastructure layer. Brands set a threshold—typically 15 to 25 requests per IP per rolling 30-minute window—and serve a rate-limit response to anything above it. The bot sees an error or a CAPTCHA; the human shopper never notices. Security Boulevard's cited report showed brands using this gate preserved conversion rates among real customers while shedding the majority of automated traffic that previously consumed inventory holds and created false sellout signals.

Why it works: scalper operations rely on speed and volume. A single bot operator runs dozens of instances, each cycling through proxy pools but often reusing the same IP ranges when rotating slowly or sharing infrastructure. The 500+ requests per IP signature is unmistakable—no human refreshes that fast. By throttling at the IP level before cart logic even fires, the brand eliminates phantom holds that tie up inventory and distort demand signals. The result is cleaner analytics, fewer angry customers who see "sold out" within seconds, and a sellout curve that reflects actual human buying behavior.

The steal for a small physical-product brand running a limited drop: use Cloudflare's free tier or a lightweight middleware like Nginx rate limiting. Set a rule: any IP making more than 20 requests to your product page or add-to-cart endpoint in a 30-minute window gets a 429 status code and a five-minute cooldown. For a Shopify store, install a rate-limiting app (several are under $10/month) and configure the threshold to match your traffic profile—monitor your analytics for a week, find the 95th percentile of requests per session, and set the gate just above it. During the drop, watch your server logs: you will see hundreds of IPs hit the limit within the first two minutes, then vanish. Your actual customers proceed unimpeded, and your inventory stays available long enough for word-of-mouth to spread.

This is not a complete bot defense—sophisticated operators use residential proxy networks that rotate IPs faster than your gate can track—but it eliminates the bulk of low-effort scalper traffic without the cost or complexity of a dedicated anti-bot SaaS. For a brand with fewer than 500 SKUs and drops under 1,000 units, IP rate limiting covers the majority of the threat surface and costs less than $50 in setup and monthly fees.

The broader pattern: scarcity marketing only works when the scarcity is real and visible. If bots consume your inventory before humans arrive, you lose the social proof and the urgency that drive organic sharing. Gating at the IP layer restores the scarcity signal to its intended audience, turning a bot-infested launch into a clean, documented sellout that customers screenshot and repost.