LayerSift
Log inStart free

← All docs

Protecting limited releases from scalpers

A sneaker drop, a console restock, a concert on-sale: a fixed number of something many more people want, sold one per customer. OWASP calls buying it up by machine scalping (OAT-005). A reseller wins by being many customers at once, and each step of a release has its own way of doing that:

Step What the reseller does What stops it
The line Hundreds of browsers take a place each, then hand the winning cookie to one checkout A waiting room: a place needs an identification, one per device, and an admission works only for the session that earned it
The cart Holds every pair in their carts the moment the page opens, then holds them again as the holds lapse Holds: units held and not bought, one item held again as it lapses
Checkout Pays with many accounts and many cards, all shipping to one door written a new way each time ("address jigging") One order per door — below
Everything Automation The verdict on the client, as on every request

The first two have their own pages. This one is about the door.

One order per door

However many accounts and cards a reseller has, the pairs go to one door — their own, or a forwarder's. Shops count orders per address to stop that, so resellers write the same door differently every time:

12 High Street            12 high st.            XJK 12 High St
12 High St, Apt 1         12 HIGH STREET #4F     12 High Strt

A carrier delivers each of those to number 12 High Street. So does an assessment with shipping: it reads the address as a delivery point — the country, the postal code (the city where there is none), the house number's digits and the street's name beside them: the word before its suffix ("High" of 12 XJK High St), or its first word where it has none — and nothing else. Not the suffix's spelling, not a unit, not letters added before the number, between it and the street or after the street, not a Cyrillic or Greek letter drawn as a Latin one and put into a Latin word (Hіgh with a Cyrillic і, which is counted as a way of writing the door, not as another door). A number in parts is read whole — Japan's 1-2-3, written 1丁目2番3号 too, a range's 12-14 — and an address in any script is read as itself: Arabic, Cyrillic or Japanese letters, and Arabic-Indic or Devanagari digits as the numbers they are. It counts, per delivery point over the last day:

  • accounts — the sign-in's account, or the signed-in user;
  • cards — the card, by your processor's fingerprint;
  • devices, by the visitor's receipt, and the client addresses orders came from;
  • variants — the distinct ways the door was written, after the differences honest typing makes ("Street" and "St.", case, accents, punctuation) are evened out.

So send shipping with the account and the card the order is from:

verdict = antibot.assess(
    ip=client_ip,
    headers=raw_header_pairs,
    method="POST",
    url="https://shop.example/drops/runner-9/checkout",
    account=customer.email,
    card=payment_method.fingerprint,
    shipping={
        "line1": address.line1,
        "line2": address.line2,
        "city": address.city,
        "postalCode": address.postal_code,
        "country": address.country,          # ISO 3166-1 alpha-2
    },
    session_token=request.cookies.get("_abid"),
)

The same in every server SDK. The response carries:

"shipping": {
  "country": "GB", "countryMatchesIp": true,
  "accountsForDestination": 12, "cardsForDestination": 11,
  "devicesForDestination": 3, "addressesForDestination": 12,
  "variantsForDestination": 12
}

What the scoring does with it

The scoring is for every shop, not only a release's, so it allows for a household (two or three people), an office, a dorm and a parcel forwarder's warehouse:

  • Ten accounts or ten cards shipping to one door in a day is a reason (velocity:accountsForDestination, velocity:cardsForDestination, 30), and twenty-five a challenge on its own (60) — one ring, seen by its accounts or its cards, counted once. Whoever passed a challenge is not asked again for these (the reasons are given at no points): a person behind a forwarder's address passes once.
  • One account or one card writing one door many ways — four or more, twice as many as the accounts and cards behind them — is jigging past a per-address limit (shipping:jigged, 40). A building's residents write their door each their own way, one account per way, and say nothing. Where orders name neither account nor card, a building cannot be told from a jig and nothing is said.

Where the order is going beside where the client is (countryMatchesIp) is reported for rules and never weighed: a gift, a traveller and a forwarder all differ.

On a release: one per door

A release sold one per customer can be held to it exactly. The rule editor's One order per door on a release refuses a second account, or a third card, shipping to the same delivery point in a day, on the path you give it:

path startsWith "/drops" and shipping.present and (shipping.accountsForDestination >= 2 or shipping.cardsForDestination >= 3)

A second card is let through because cards are counted when the order is assessed, before it is paid: a person whose first card was declined tries another. A household that wants two pairs gets one — and a block of flats is one door here, so two neighbours after the same release get one between them. Everything else in the response is there for rules too (shipping.* — see rules).

What it cannot see

  • A unit inside a building. "Apt 4" is the jig most often added, so a unit is never part of the point: a block of flats — and in Singapore, where a postal code is a building, or Hong Kong, where there are none, a whole tower — is one door. The scoring's thresholds allow for a building; the one-per-door rule above does not.
  • Two streets with one word in common in one postal code are one point: "12 Oak Street" and "12 Oak Avenue" (the same name), and "12 Hyde Park Street" and "12 Park Street" (the word before the suffix is the name read). The street is read by one word, which a jig leaves alone; read by all of its words, a word put in front of the name would be a new door. A jig that misspells the name moves it, and so does one put between the number and a street written without a suffix ("12 XJK High").
  • An address with neither a postal code nor a city is no door at all — every "12 Oak Street" in a country would be one — and nothing is counted for it.
  • A door with no number — a named cottage, a rural route — is read by its words, in any order, without suffixes. A jig that changes the words moves it.
  • A number put before the real one ("12 7X High St") can move the point, as can a fake postal code; carriers often deliver those anyway. Fake units ("Apt 1", "Apt 2") move nothing: they are not the house.
  • A different door. A reseller with many real addresses — friends, forwarders — is many customers to any shop; the accounts, cards, devices and the client behind them are what is left to go on.

The address is never stored. Every value counted is a keyed digest, kept two days.