What is a Sneaker Bot?
A sneaker bot, commonly referred to as a “shoe bot”, is a sophisticated software component designed to help individuals quickly purchase limited availability stock.
After using the bot to make purchases, bot users often resell the product at a higher price. As a result, customers become frustrated and the company suffers significant damage to its reputation.
Initially, sneaker bots were created to help their operators purchase a big quantity of limited-edition sneakers. Today, these bots are used to purchase any item in limited availability or products restricted to certain geographical regions.
How Do Sneaker Bots Work?
To use a sneaker bot, bot users need to enter data into the software, such as credit card information, name, and shipping address. Once they input the information, they can specify what the bot should purchase. This is usually achieved by entering a list of product URLs or keywords. Bot users may retrieve initial information (such as product URLs) from “cook groups” that offer support for botters.
Once the bot is initiated, the checkout process runs automatically and the bot can purchase goods faster than humans can.
Sneaker Bot Architecture
Operating a sneaker bot requires several components:
- The bot itself
- A proxy server
- Proxy clients that provide IP addresses
The proxy server provides access to a large number of proxies, and can be used to parallelize the bot, running it multiple times against the same website.
The proxies give each instance of the bot a unique IP address. A bot uses multiple IP addresses to make it seem like multiple people are performing actions. For example, mass-entering into one online queue can increase the odds of actually making a purchase.
A proxy helps mask bots as multiple buyers. Otherwise, a targeted website can determine that all entries are from one source and ban the IP.
Upcoming Webinar
Cracking the Code: Defending APIs from Business Logic Attacks
Register Now
Are Sneaker Bots Illegal?
Sneaker bots are not illegal – they are not traded on the dark web or black market. In fact, most bot makers have websites, run advertisem*nts, and publicly list their prices. As long as the purchases are made through the proper digital channels, using a sneaker bot is not considered illegal. However, sneaker bots do violate the terms and conditions defined by many websites.
The majority of retail stores are taking active steps to combat the use of sneaker bots. Supreme, Shopify, Foot Locker, Nike, and Adidas are all familiar with bots and regularly update online protections to prevent the use of these bots. These updates typically include coding changes designed to differentiate between bots and human users. However, bots quickly update their operating software to avoid new protective measures.
How Sneaker Bots Impact Customers and Online Businesses
Here are several ways in which sneaker bots negatively impact customer experience as well as the bottom line of businesses:
- Damaged brand reputation—when a bot collects all stock, or makes it look like there is no stock by hoarding inventory, customer experience is negatively impacted. Bots prevent real customers from purchasing sneakers and other items in high demand. This causes frustration, making customers think the website cannot meet their needs. As a result, customers will not only look for another site for the current purchase, but they may also avoid returning to the same site or brand in the future.
- Loss of revenue—because bots scoop up the inventory before real customers can make purchases, websites are essentially losing these potential customers. When this happens, websites cannot offer these lost customers other offerings or establish a better relationship. Previous customers cannot be reached out for loyalty offerings and new customers are lost. These impacts can have long-term consequences and siphon future returns.
- Loss of brand loyalty—even if website owners make money by selling high-demand items to bot operators, they lose brand loyalty, which would cause ordinary customers to come back to buy additional items. A bot operator does not recommend online stores to friends or socialize with new products bought in stores like real consumers. That means they may have to work harder and spend more money to attract real consumers.
- Increased infrastructure costs—website owners facing automated traffic flowing into their sites have to pay unnecessary bandwidth and infrastructure costs (and the human resources needed to support them). Scanners and bots cause massive spikes in traffic, typically between 10 to 100 times more than normal users, resulting in unnecessary overheads.
- Slow website speed—bot traffic can significantly slow down a website and cause delays. Slow site speed frustrates consumers, who may abandon their purchase or stop using the site altogether. The result is a decrease in authentic conversions.
- Distorted web metrics—fake bot traffic can skew analytics and make it difficult to understand real consumer behavior on a website, so website owners cannot optimize their site for conversions.
How Do Sneaker Bots Evade Detection?
Sneaker bot developers are familiar with the main bot detection mechanisms and do their best to bypass them. Here are several strategies used by sneaker bot developers:
Fake Browser Fingerprints
The most sophisticated sneaker bots create custom browser and HTTP fingerprints that appear to be real users. For example, they use certain browser features, apply fake user agents, delete the navigator, web driver property, and more.
Simulated Human Behavior
To be effective, a sneaker bot needs to imitate the behavior of human customers. This is why a bot does necessarily purchase goods at the fastest possible speed. Instead, it operates at a slower speed, emulating human activity, but strives to buy goods faster than other buyers. The bot mimics real mouse movements and touch screen events. It can also simulate keystrokes that regular human visitors typically make.
Residential IP Addresses
Low-end sneaker bots use data center proxies, but the most advanced bots rely on residential proxies. Because these proxies are more expensive than data center proxies, they are less abused and generally have better reputations, which makes it more difficult to detect bots.
CAPTCHA Bypass
A good sneaker bot can easily bypass CAPTCHA mechanisms. Bots use a variety of techniques to bypass CAPTCHA, including:
- Using human assistance – offshore workers can solve a large number of CAPTCHA puzzles at a very low cost
- Using image classification algorithms to solve image-based puzzles and logic-based algorithms for numeric puzzles
- Using generative adversarial networks (GAN) to automatically generate creative solutions to complex CAPTCHA puzzles
Low Request Volumes per IP Address
As a result of using residential IP addresses, the number of requests per IP address is reduced. Unlike crawlers or bots that perform credential stuffing attacks, sneaker bots do not need to generate many requests. Users can also parallelize the sneaker bot with different browser instances that utilize multiple residential proxies. In this way, each IP used by the bot has a normal number of requests.
See how Imperva Bot Management can help you with Sneaker bots.
Request demo Learn more
Imperva Bot Protection
Imperva provides an Advanced Bot Protection solution that can mitigate sneaker bots and other bad bots. Bot Protection prevents business logic attacks from all access points – websites, mobile apps, and APIs. It provides seamless visibility and control over bot traffic to stop online fraud, through account takeover or competitive price scraping.
Beyond bot protection, Imperva provides comprehensive protection for applications, APIs, and microservices:
Web Application Firewall – Prevent attacks with world-class analysis of web traffic to your applications.
Runtime Application Self-Protection (RASP) – Real-time attack detection and prevention from your application runtime environment goes wherever your applications go. Stop external attacks and injections and reduce your vulnerability backlog.
API Security – Automated API protection ensures your API endpoints are protected as they are published, shielding your applications from exploitation.
DDoS Protection – Block attack traffic at the edge to ensure business continuity with guaranteed uptime and no performance impact. Secure your on premises or cloud-based assets – whether you’re hosted in AWS, Microsoft Azure, or Google Public Cloud.
Attack Analytics – Ensures complete visibility with machine learning and domain expertise across the application security stack to reveal patterns in the noise and detect application attacks, enabling you to isolate and prevent attack campaigns.
Client-Side Protection – Gain visibility and control over third-party JavaScript code to reduce the risk of supply chain fraud, prevent data breaches, and client-side attacks.
