# How do you read bot traffic in your logs during a product drop? | Bot Traffic Index

Source: https://bottrafficindex.com/blog/2026-10-06-bot-traffic-product-drop-logs.html

Oct 6, 2026 - Bot Traffic Index


Product drops compress a week's worth of bot activity into ten minutes. Reading the logs means separating hype traffic from scalper infrastructure: request timing, IP diversity, and checkout completion rates.

## The drop as a bot magnet

A hyped product drop is the highest-ROI ten minutes in a scalper's month, which means your logs during a drop look nothing like your logs on a normal Tuesday. Expect traffic spikes of 10x to 100x, the vast majority of it automated: monitoring bots watching for the drop to go live, scalper infrastructure hammering the product page, and reseller tools racing through checkout. Humans are in there too, but they are the minority of requests.

The first discipline is not to panic at the shape of the spike. A tall, narrow traffic spike with a fast decay is a normal drop pattern, bots included. What you are looking for is structure inside the spike: which requests behave like infrastructure and which behave like people, because the two need completely different responses.

## Timing signatures: humans vs infrastructure

Plot request timestamps at millisecond resolution and the populations separate themselves. Human traffic during a drop is bursty but irregular: page loads cluster around the announcement, with natural variation in the gaps. Bot infrastructure shows metronomic regularity: requests at fixed intervals, add-to-cart attempts spaced with inhuman precision, or waves synchronized across hundreds of sessions starting within the same second.

The monitoring bots are the easiest to spot: they poll the product page or the inventory API at fixed intervals for hours before the drop, then go quiet or shift pattern the instant stock appears. Scalper checkout bots show a different signature: product page to cart to checkout in under two seconds, repeated across sessions with identical timing. Humans cannot do that. When you see it, you are looking at automation, not enthusiasm.

## IP diversity and what it tells you

Count distinct IPs per hundred add-to-cart attempts. Real hype traffic comes from many IPs with one or two carts each: thousands of fans, each trying once. Scalper infrastructure inverts this: a small number of IPs generating hundreds of attempts, or a large number of residential proxy IPs each generating a handful of attempts with identical fingerprints.

The residential proxy case is the tricky one, because IP diversity looks human. The tell is fingerprint consistency: identical user agents, identical screen resolutions, identical behavioral timing across supposedly distinct users. No two humans configure their browsers identically. When fifty 'different' shoppers share a fingerprint down to the plugin list, they are one operator. Log TLS fingerprints and canvas hashes during drops if your stack supports it; they are worth more than IP addresses against modern scalper tooling.

## Checkout completion is the filter

The metric that cuts through everything is checkout completion rate by segment. Monitoring bots never check out. Scalper bots check out at high rates when they win and vanish when they lose. Humans check out at low, steady rates with high cart abandonment. Segment your drop traffic by behavioral cluster and compute completion per cluster, and the business impact becomes concrete.

This is also where you measure whether your bot defenses worked. A drop with aggressive queueing and bot filtering should show human completion rates holding steady while automated attempt volume gets absorbed by the defenses. If human completion dropped versus the last undefended drop, the defenses cost you real customers and need tuning. Defenses are not free; they trade some human friction for scalper exclusion, and the logs are where you verify the trade was worth it.

## What to log before the next drop

You cannot analyze what you did not record, so set up drop-specific logging before the next one. Minimum viable: millisecond timestamps on every request, full user agent strings, IP addresses, TLS fingerprints if available, session IDs carried from product page through checkout, and outcome labels for every cart and checkout attempt.

Retain the raw logs for at least 90 days; drop analysis happens after the fact, when someone asks whether the scalpers won. And write the post-drop report while the data is fresh: attempt volume by cluster, human completion rate, estimated scalper share of inventory, and what the defenses caught versus missed. The report is what turns a chaotic ten minutes into an institutional memory, so the next drop starts from evidence instead of adrenaline.

## Frequently asked questions

### What does bot traffic look like in logs during a product drop?

Bursts far faster than human browsing: hundreds of product and cart requests per minute from narrow network ranges, repeated refresh of the same launch pages, failed checkouts in batches, and traffic that ignores images and content pages entirely in its hurry to transact.

### Why do drops attract more bots than normal days?

Scarcity creates resale margin, and margin funds automation: bots are built to buy faster than people, hold inventory in carts, and test stolen payment details against a store whose defenses and staff are busy. The drop concentrates value, and automated traffic follows value.

### How should a store prepare its logging before a drop?

Decide the questions in advance: request rates by path, cart and checkout initiations, payment failure rates, and network sources, with alerts on the few that signal attack. Teams that define drop metrics beforehand read the day clearly. Teams that improvise metrics mid drop argue while it happens.

### What should be reviewed after the drop ends?

Whether genuine shoppers could buy: sellout speed for real sessions, cart holds by suspicious traffic, payment failure patterns, and which defenses triggered. The post drop review is where the next drop's settings come from, and it should happen within days, while the logs and the team's memory are both fresh.