Slide 13 of 28
Part 2 · How It WorksSlide 13
Slide 13 · Real Incident: Sneaker Bots
Sold out in seconds. On resale in minutes. Retail never had a chance.
Nike SNKRS and the sneaker bot industry — a commercial ecosystem built on business flow abuse.
Real Incident · Ongoing since ~2015, peak ~2020–present
Sneaker Bot Industry — Automated Checkout on Nike SNKRS and Retail APIs

Nike, Adidas, New Balance, and other brands release limited-edition sneakers through apps and websites. The SNKRS app (Nike) uses a raffle or “draw” system; direct retail sites use first-come-first-served checkout. The sneakers sell for $150–$200 retail. Resale values reach $500–$2,000+.

A commercial bot software industry has grown around this market. Products like Nike Shoe Bot, AIO Bot, Cyber AIO, and others sell for $300–$500 per license (or $50+/month subscriptions). They automate: account creation, size selection, payment submission, and checkout completion — all in milliseconds.

A 2021 study by Imperva found that nearly 40% of all traffic to retail sites during limited-release events was bot traffic. On specific high-demand releases (Air Jordan collaborations, Yeezy drops), sellouts occur in under 10 seconds — before most human users complete the page load.

Nike has implemented increasingly sophisticated countermeasures: CAPTCHA, device fingerprinting, purchase limits, raffle systems, and bot detection. The bot industry responds with countermeasures to each defense: CAPTCHA-solving services, browser automation that mimics human behavior, residential proxy networks. It is an ongoing arms race with significant commercial stakes on both sides.

Lesson: Business flow abuse at the API layer has spawned a commercial industry. The defenses are not one-time implementations — they require ongoing adaptation as attackers counter each new control. Bot mitigation is an operational capability, not a deployment checklist.
← Back See it in attack scenarios →