Security Boulevard documented a repeating scalper-bot attack pattern on limited-edition product drops: approximately 70 IP addresses each firing more than 500 requests during a single 30-minute release window, according to the security analysis. One in five malicious requests targeted inventory availability endpoints, the report found.
The mechanics are straightforward. Bots saturate the availability API during the drop window, probing stock levels faster than human shoppers can click. When inventory confirms, the same IPs pivot to checkout automation. The volume creates a two-layer problem: legitimate customers face slowdowns or timeouts, while the fastest bots capture allocation before most shoppers load the product page.
The pattern works because most small-brand infrastructure treats all traffic equally during launch. Standard rate-limiting by IP misses the threat — 70 IPs distributing 500+ requests each stays under simple thresholds that would flag a single IP hammering the server. Inventory endpoints often sit outside authentication, making them cheap to probe. The result: bots map stock faster than the brand can detect the attack, then execute checkout through residential proxies or stolen credentials the moment product goes live.
The steal for a small physical-product brand running its own limited drop: protect the inventory signal, then choke the funnel. Move your stock-check API behind authentication — even a simple email capture before someone can query "is this available" cuts bot efficiency by half. If you cannot gate the endpoint, add a randomized delay of two to five seconds on all availability responses during the drop window. Bots built for speed hate unpredictable latency.
Second, limit checkout velocity per session, not per IP. Allow one cart creation per session token per 10 minutes during the drop. When a session tries to modify the cart or re-add product after clearing, flag it. This catches the bot pattern of rapidly testing combinations or churning through proxies. Cost to implement: a single middleware rule in Shopify, WooCommerce, or any headless cart. No third-party security vendor required.
Third, separate your launch-day traffic into two lanes. Serve your email list or SMS subscribers on a dedicated subdomain with a unique product URL, announced 15 minutes before the public drop. Bots monitoring your main site miss the early window. Even a 15-minute head start lets real customers claim 30 to 40 percent of inventory before the scraper swarm finds the link. Drop the public URL exactly on time, but by then you have already converted your owned audience.
The broader pattern: scarcity is a liability when your infrastructure assumes good faith. Bots do not wait for page load. They do not browse. They query the stock endpoint and execute. If your limited drop treats inventory visibility as a free public resource, you are handing scalpers the unfair advantage. The fix is not exotic — it is gating the signal, slowing the read, and rewarding the customers who already trust you with a structural head start.