The Automated Hoarders Behind Holiday Stock Shortages
When hot holiday items sell out in seconds, the culprit is often not a surge of eager shoppers — it’s software. Retailers face a seasonal spike in automated traffic designed to buy up limited inventory before humans get a chance. The phenomenon is common enough that US lawmakers recently introduced the Stopping Grinch Bots Act to curb the practice.
These so-called "Grinch Bots" are simply programs that make automated requests to ecommerce sites. Two traits define them: they target online inventory to purchase items faster than humans can complete orders, and they operate mainly during the holiday season. While similar bot attacks happen year-round, the holiday spike is severe enough to warrant its own nickname.
Billions of Automated Requests During Peak Shopping Days
The busiest shopping days of the year are also the busiest for bots. Cloudflare detected nearly 1.5 trillion bot requests on Black Friday alone — roughly half of all traffic observed that day. The Grinch Bot knows discounts peak around Thanksgiving and that exclusive items sell out first, so it cuts every virtual line and checkpoint.
The pattern continues on Cyber Monday. Bots are often ten steps ahead of shoppers, automatically adding items to carts and ready with payment details. A single bot can buy 500 pairs of joggers in seconds while a human shopper struggles to complete a single order.
Bad Bots Make Up a Growing Share of Web Traffic
These seasonal attackers have year-round counterparts that test tactics on major sites for months before the holidays arrive. Cloudflare reports that 43.8% of Internet traffic comes from bad bots. When the shopping season hits, that number surges further.
Bot traffic on Black Friday climbed to nearly 50%, and Cloudflare Radar showed data close to 55% when including good bots — automated traffic like search engine crawlers. Businesses consistently identify this as the most vulnerable time of year for their sites.
Hundreds of Billions of Attempted Purchases
Bots operate at scales humans cannot match. While a person might buy one or two items in a few minutes, bots can drain far more inventory with little effort.
Over the course of a year, Cloudflare observed more than 300 billion bot attempts to "add to cart." The company identified these by running bot detection engines on every endpoint containing the word "cart." Most bots were stopped even earlier in their efforts, meaning the total number of inventory hoarding attempts is far higher.
Some bots skip retail sites entirely and target banks instead. These automated attackers test stolen credentials and try to break into accounts to steal holiday funds. Cloudflare reports 71% of login traffic comes from bots.
Response Tactics: From Rate Limiting to JS Challenges
Retailers have multiple options to fight back. Many block individual IP addresses, groups of devices, or entire countries. Others use Rate Limiting to reduce traffic volume. More sophisticated approaches like Bot Management dynamically identify threats as they appear.
Cloudflare favors JS Challenges as a lightweight, non-interactive alternative to CAPTCHAs. These challenges give suspicious requests a chance to prove their legitimacy, acting as a middle ground between taking no action and completely blocking requests.
The approach scales with threat levels. Cloudflare issued over 35 billion JS Challenges over the holiday shopping weekend. On Black Friday alone, it blocked more than 150 billion threats.
Interestingly, bot traffic decreased as the shopping weekend continued, with Cyber Monday seeing less automated activity than expected. The likely explanation: bots spent their time hitting blocks and JS Challenges until they gave up.
A Free Option for Smaller Sites
Large retailers can afford commercial bot solutions, but smaller sites often cannot. Cloudflare offers Bot Fight Mode as a free, one-click tool that draws on its detection engines.
Bot Fight Mode goes beyond simply stopping bots. It unleashes a tarpit challenge that occupies each bot with nonsense puzzles, driving up the operator's server costs. Cloudflare even plants trees to offset the carbon emissions of these expensive challenges.
