Anti-Bot Technology vs. Botting Techniques – A Timeline Breakdown
Anti-bot technology on sneaker sites has moved from simple CAPTCHAs, rate limits and IP blocks in 2018 to layered systems built on behavioral analysis and machine learning by 2026. Botting techniques evolved alongside it, from fast single-site scripts to AIO bots spread across many accounts, IPs and retailers. Each new defense pushed bot developers to adapt, and each adaptation pushed retailers to respond, which is why this timeline reads as an arms race rather than a fix.
- In 2018, a single AIO bot could target more than 120 retailers at once, according to Akamai’s 2019 State of the Internet retail report.
- In November 2022, Nike’s figures put bot submissions at 10% to 40% of SNKRS entries, as reported by Sneaker News.
- Bots made up 53% of all web traffic in 2025, according to the Thales 2026 Bad Bot Report.
The sneaker industry has spent years dealing with automated bots competing for limited releases. As sneaker and retail bots became more advanced, retailers developed more sophisticated anti-bot technology. What started with relatively simple tools has evolved into systems that analyze large amounts of traffic and use behavioral analysis and machine learning.
This timeline looks at how the competition between sneaker bots and anti-bot technology developed from 2018 to 2026.
What Is the Sneaker Anti-Bot Arms Race?
The sneaker anti-bot arms race is the back-and-forth between retailers protecting limited releases and the developers of bots built to buy them. Each side’s move tends to trigger the other’s next one, so the clearest way to follow it is year by year.
The table sums up the timeline below, pairing what bots were doing with how retailers answered.
2018: The Rise of Automated Sneaker Shopping
By 2018, sneaker bots were already established tools for automated purchasing. Bots could monitor product availability and automate parts of the purchasing process across multiple retailers.
Akamai’s research from this period documented AIO bots that could work across numerous retailers, use multiple logins, and react automatically to product availability. Akamai’s 2019 State of the Internet retail report found that a single AIO bot could target more than 120 retailers at once. The same report counted more than 10 billion credential abuse attempts against retail sites between May and December 2018.
Apparel was the most targeted retail vertical, with 3.7 billion of those attempts, according to Chain Store Age’s coverage of the report. Retailers commonly relied on basic measures such as IP restrictions, rate limiting, and CAPTCHA challenges. These could stop simpler automation, but determined bot operators could adapt their setups to avoid individual restrictions.
2019: Bot Detection Becomes More Sophisticated
By 2019, bot management was moving beyond simple blocklists. Security companies were developing systems that could analyze traffic in real time and use artificial intelligence to help identify automated activity.
The goal was no longer simply to block an IP address or display a CAPTCHA. Retailers increasingly needed to determine whether traffic actually represented a human user or automated software. Akamai data published that year put bots at 60% of all web traffic, with fewer than half of them identified as bots, according to Chain Store Age.
This marked an important change in the anti-bot arms race. Blocking individual sources could still be useful, but sophisticated automation could change its traffic patterns and sources. That is part of why proxy choice became such a big part of every bot setup.
2020: The Cat-and-Mouse Game Continues
The sneaker bot problem became far more visible in 2020 as online releases grew more important. High-demand launches could generate large amounts of automated traffic, putting pressure on both retailers and their infrastructure.
Retailers experimented with different combinations of CAPTCHAs, rate limiting, IP blocking, and specialized bot protection. However, these measures were not always enough against distributed automation. A limit of 10 requests a minute per IP does little against 500 IPs each sending 9, which still adds up to 4,500 requests a minute without tripping the limit once.
By this point, the industry was increasingly treating bot detection as an ongoing process rather than a problem that could be solved with one security feature. That shift in thinking set up the behavioral approach that followed.
2021: Behavioral Analysis Gains Importance
Behavioral analysis became central to anti-bot systems in 2021, as bots got better at imitating ordinary browser activity. Instead of relying only on obvious technical indicators, systems increasingly looked at how traffic behaved.
This included analyzing patterns across:
- requests and sessions
- accounts
- devices
- other signals tied to the same activity
The objective was to identify suspicious automation even when the traffic did not look obviously malicious at first glance.
For retailers, this created a more complex defensive system. Instead of asking only whether a request came from a known bad IP address, systems could evaluate the broader behavior associated with it. That includes how an account moves between pages, or how closely its timing matches hundreds of other accounts.
2022: Major Retailers Publicly Explain Their Defenses
Nike provided one of the clearest public examples of modern sneaker anti-bot systems in 2022. On its SNKRS fairness page, Nike explains that it uses a variety of tools to identify and remove bots, including advanced analytics and machine learning.
Nike says it evaluates launches “both in real time, and retroactively” so its defenses can evolve as bot developers change their methods.
When Nike published those details in November 2022, Sneaker News reported that bot submissions made up 10% to 40% of total entries, with as many as 20 million removed from SNKRS launches each month. This was significant because it showed how far anti-bot systems had moved from basic CAPTCHA-based protection.
The same disclosure also showed the limits of any single defense. On that same page, Nike acknowledges that a small fraction of bot entries may still succeed on a given launch, because bot development keeps evolving.
2023: Scale Becomes a Major Part of the Problem
By 2023, the scale of automated traffic had become a major concern for big sneaker releases. Nike’s figures, as reported by Sneaker Freaker, put bot attacks at about 10% to 50% of all SNKRS entries. On a draw with 1,000,000 entries, that range would mean between 100,000 and 500,000 bot entries competing with real ones.
This highlighted an important reality: anti-bot systems were not only dealing with individual scripts trying to buy a pair of sneakers. They were dealing with large amounts of automated traffic, multiple accounts, distributed infrastructure, and constantly changing techniques.
Bot protection therefore became increasingly focused on identifying patterns across large volumes of activity rather than relying on a single indicator.
2024–2026: Layered Detection and Continuous Adaptation
The modern anti-bot approach is built on multiple layers working together. Instead of relying on one CAPTCHA or one IP block, retailers can combine traffic analysis, behavioral signals, device information, rate controls, machine learning, and other detection methods.
The botting side has changed too. According to Imperva’s 2025 Bad Bot Report, as covered by Security Boulevard, 21% of bot attacks used residential proxies provided by ISPs to blend in with genuine user traffic.
The important change is that neither side stays still. Bot developers modify their software when retailers introduce new defenses, while retailers analyze new automated behavior and adjust their detection systems. A technique that works against one defense may become ineffective after that defense is updated, and a new bot technique can force retailers to build additional detection methods.
How do retailers detect sneaker bots today?
Retailers detect sneaker bots today by combining several signals rather than trusting any single one. A typical stack layers:
- Traffic analysis for request volume and patterns
- Behavioral signals across sessions and accounts
- Device and browser information
- Rate controls and queues
- Machine learning that reviews launches in real time and afterward
No single layer has to catch everything, because a request that slips past one can still be flagged by another.
Do CAPTCHAs still work against sneaker bots?
CAPTCHAs still work as one layer, but they are no longer the main defense. They stop simpler automation and add friction to suspicious sessions. The real decision usually comes from the risk scores and behavior checks running around them. Our CAPTCHA breakdown covers how reCAPTCHA, hCaptcha, and Turnstile each handle that.
How Much Web Traffic Comes From Bots?
Bots now make up more than half of all web traffic, according to the most recent vendor reports, and the share keeps climbing. The table compares three reports. Each vendor measures traffic differently, so read the figures as a trend rather than exact like-for-like numbers.
The Thales figures show the bad-bot share rising 3 percentage points in a single year, from 37% to 40%. Sneaker launches sit at the sharp end of that trend. A limited release concentrates both demand and automation into a few minutes, which is exactly where retailers’ detection gets tested hardest.
Why Does the Anti-Bot Arms Race Continue?
The anti-bot arms race continues because the underlying problem has not changed much. Limited sneaker releases create a large gap between supply and demand. Nike’s own SNKRS fairness page says demand for its most coveted drops often far exceeds supply. That gap makes automation financially attractive to some buyers.
What has changed is the technology on both sides. Early sneaker bots could rely heavily on speed and automation. Modern bots have become more sophisticated, while retailers have moved toward analyzing behavior and combining multiple signals.
This means anti-bot technology is no longer simply about stopping software from reaching a website. It is about continuously deciding which activity looks legitimate and which looks automated.
Where the Arms Race Goes From Here
From 2018 to 2026, the battle between sneaker bots and anti-bot technology moved from relatively simple protections toward increasingly sophisticated detection systems.
CAPTCHAs, IP blocks, and rate limits remain useful tools, but modern retailers rely more and more on layered defenses, behavioral analysis, analytics and machine learning. At the same time, bot developers keep adapting to each new defense.
The result is an ongoing cycle: retailers improve detection, bot developers adapt, and retailers respond with new techniques. As long as limited releases stay this competitive, the arms race is likely to continue. The next entry on this timeline will probably belong to whichever side adapts fastest.
