# Drop security blocked ~70 IPs firing 500+ requests per 30 minutes in live inventory test *Bot-blocking infrastructure stopped 1 in 5 malicious requests at the inventory layer during limited drops.* By **Jenny Huang Goodman MPA MSc MHSA, Principal** — The Stash Edge, Hako Shikin LLC. Published 2026-07-19. Canonical: https://www.pops4.com/stash/articles/scalper-bot-defense-infrastructure-2026-07-19t12-5 Subject: Scalper Bot Defense Infrastructure Tags: drops, bots, security, scarcity, cloudflare, rate-limiting --- A drop-defense system intercepted approximately **70 IP addresses** each firing more than **500 requests** in a single **30-minute window** during a limited-edition release, according to Security Boulevard. The infrastructure blocked roughly **1 in 5** malicious requests to the inventory-availability endpoint at peak, maintaining zero downtime while filtering coordinated bot traffic. The brand implemented rate-limiting at the inventory-query layer, isolating requests that checked stock availability in rapid succession. Rather than blocking all traffic, the system flagged clusters of IPs exhibiting coordinated behavior—identical request intervals, sequential user-agent strings, and shared fingerprinting metadata—and throttled them before they reached the checkout API. The result: real buyers saw normal load times, scalper bots hit request caps, and the brand preserved sellthrough without cart-abandonment spikes from frustrated humans. The mechanism works because scalper bots rely on aggressive polling to detect the moment inventory goes live. Unlike a human refreshing a product page every few seconds, a bot can query availability endpoints hundreds of times per minute, often from multiple IPs to evade simple rate limits. By placing the defense at the inventory-availability layer rather than the homepage or checkout, the brand targeted the bottleneck where bots reveal themselves. High-frequency, coordinated queries are statistically distinct from organic traffic, even during a surge. The system also correlated IP behavior across sessions, catching bots that rotated addresses but maintained request patterns. A small physical-product brand running drops on Shopify or WooCommerce can deploy this defense using Cloudflare's rate-limiting rules or a lightweight WAF service. Set a rule that flags any IP querying the product JSON endpoint (typically `/products/{handle}.json` on Shopify) more than **10 times per minute**. Use Cloudflare's managed challenge to force flagged IPs through a CAPTCHA before allowing further requests. Cost: Cloudflare Pro at **$20 per month** covers basic rate-limiting; Cloudflare's Bot Management tier at **$200 per month** adds fingerprinting and machine-learning detection. For brands on custom stacks, implement server-side rate-limiting in Nginx or Express middleware, logging IP, timestamp, and endpoint, then blocking IPs exceeding the threshold for a rolling **5-minute window**. Publish drop times exactly, but do not pre-load inventory data into client-side JavaScript. Bots scrape page source; serving inventory via server-side render or API request after page load forces them to query endpoints, exposing their traffic pattern. The broader pattern: scarcity drives revenue, but only if real customers capture the inventory. Every bot-blocked request is a human who gets a fair shot, and every human who gets a fair shot is likelier to return for the next drop. Rate-limiting at the availability layer is the least-friction gate that separates signal from noise. ## The takeaway Block bots at the inventory-query layer, not checkout, to stop scalpers without slowing real buyers. --- ## Publisher **Hako Shikin LLC** — Virginia Beach, Virginia. Founded 1997. ASI 217876 · DUNS 18-204-6339. Principal and author: **Jenny Huang Goodman MPA MSc MHSA**. - Author: https://www.huanggoodman.com/about - LLM context: https://www.pops4.com/stash/llms.txt - MCP endpoint, for AI agents: https://mcp.pops4.com/mcp - Client dashboard: https://dashboard.pops4.com/ - Catalogue: 70,000+ products, 200+ brands