How do you read bot traffic in your logs during a product drop?
Product drops compress a week's worth of bot activity into ten minutes. Reading the logs means separating hype traffic from scalper infrastructure: request timing, IP diversity, and checkout completion rates.
The drop as a bot magnet
A hyped product drop is the highest-ROI ten minutes in a scalper's month, which means your logs during a drop look nothing like your logs on a normal Tuesday. Expect traffic spikes of 10x to 100x, the vast majority of it automated: monitoring bots watching for the drop to go live, scalper infrastructure hammering the product page, and reseller tools racing through checkout. Humans are in there too, but they are the minority of requests.
The first discipline is not to panic at the shape of the spike. A tall, narrow traffic spike with a fast decay is a normal drop pattern, bots included. What you are looking for is structure inside the spike: which requests behave like infrastructure and which behave like people, because the two need completely different responses.
Timing signatures: humans vs infrastructure
Plot request timestamps at millisecond resolution and the populations separate themselves. Human traffic during a drop is bursty but irregular: page loads cluster around the announcement, with natural variation in the gaps. Bot infrastructure shows metronomic regularity: requests at fixed intervals, add-to-cart attempts spaced with inhuman precision, or waves synchronized across hundreds of sessions starting within the same second.
The monitoring bots are the easiest to spot: they poll the product page or the inventory API at fixed intervals for hours before the drop, then go quiet or shift pattern the instant stock appears. Scalper checkout bots show a different signature: product page to cart to checkout in under two seconds, repeated across sessions with identical timing. Humans cannot do that. When you see it, you are looking at automation, not enthusiasm.
IP diversity and what it tells you
Count distinct IPs per hundred add-to-cart attempts. Real hype traffic comes from many IPs with one or two carts each: thousands of fans, each trying once. Scalper infrastructure inverts this: a small number of IPs generating hundreds of attempts, or a large number of residential proxy IPs each generating a handful of attempts with identical fingerprints.
The residential proxy case is the tricky one, because IP diversity looks human. The tell is fingerprint consistency: identical user agents, identical screen resolutions, identical behavioral timing across supposedly distinct users. No two humans configure their browsers identically. When fifty 'different' shoppers share a fingerprint down to the plugin list, they are one operator. Log TLS fingerprints and canvas hashes during drops if your stack supports it; they are worth more than IP addresses against modern scalper tooling.
Checkout completion is the filter
The metric that cuts through everything is checkout completion rate by segment. Monitoring bots never check out. Scalper bots check out at high rates when they win and vanish when they lose. Humans check out at low, steady rates with high cart abandonment. Segment your drop traffic by behavioral cluster and compute completion per cluster, and the business impact becomes concrete.
This is also where you measure whether your bot defenses worked. A drop with aggressive queueing and bot filtering should show human completion rates holding steady while automated attempt volume gets absorbed by the defenses. If human completion dropped versus the last undefended drop, the defenses cost you real customers and need tuning. Defenses are not free; they trade some human friction for scalper exclusion, and the logs are where you verify the trade was worth it.
What to log before the next drop
You cannot analyze what you did not record, so set up drop-specific logging before the next one. Minimum viable: millisecond timestamps on every request, full user agent strings, IP addresses, TLS fingerprints if available, session IDs carried from product page through checkout, and outcome labels for every cart and checkout attempt.
Retain the raw logs for at least 90 days; drop analysis happens after the fact, when someone asks whether the scalpers won. And write the post-drop report while the data is fresh: attempt volume by cluster, human completion rate, estimated scalper share of inventory, and what the defenses caught versus missed. The report is what turns a chaotic ten minutes into an institutional memory, so the next drop starts from evidence instead of adrenaline.