Keep ticket on-sales for fans, not scalper bots
Demand for a big event lands in the first minutes of the on-sale, and so do the bots. Centinel evaluates how each request to the event, seat, and checkout pages was made, so fans get through and scripted buyers get a different response.
Request a site auditThe on-sale is the one minute that matters
Scripts that refresh the event page, hold seats in carts, and check out across many accounts all arrive in the same minutes as the fans, on the same routes. A rule that slows every visitor down on the busiest minute of the year punishes the people it is meant to protect. The response has to depend on how each request was made.
Read the researchWhat the traffic looks like
Checkout faster than a person can
Scalper bots (OWASP OAT-005) load the event page, pick seats, and pay the moment inventory opens, then list the tickets for resale.
Seats held, never bought
Seat-spinning scripts put seats in carts over and over so no one else can buy them. OWASP files this under OAT-021 Denial of Inventory.
Purchase limits split across accounts
A per-account ticket limit stops one account, not one operator. Scripts register fan accounts in bulk, or take over existing ones, to buy past the limit.
What runs against this traffic
Evidence on event, seat, and checkout routes
In supported browser deployments, Centinel evaluates request and browser evidence on the event page, seat selection, and checkout.
Scripted buying can be challenged or blocked while fans with ordinary sessions see no extra step. Centinel is not a waiting room and does not set purchase limits.
Read moreA separate policy for seat holds
Seat-hold and add-to-cart routes can carry their own response, separate from the policy for browsing the event page.
Repeated scripted holds can be rate-limited or challenged before they take inventory off sale. Hold times and cart rules stay in your ticketing system.
Read moreEvidence around fan sign-up
In supported sign-up flows, Centinel evaluates the session around account creation, not only the submitted details.
Accounts opened in bulk before an on-sale can be challenged or reviewed. Centinel does not verify who a fan is.
Read moreA login policy for accounts that hold tickets
Where the integration supports it, login attempts can be observed, rate-limited, challenged, or blocked by how they were made.
Credential stuffing against accounts with tickets in them meets friction. Centinel does not decide whether a password was stolen.
Read more
Want to see what reaches your site?
Start with a free scraping audit: tested tools, exposed pages, and fixes to consider, reviewed by hand and emailed to you. This checks scraping exposure, not every abuse pattern or all production traffic. Discuss broader workflow coverage in a demo.
Ticketing & live events: common questions
What platform and security teams ask before they deploy.
What is a ticket bot?
A ticket bot is a script that buys event tickets automatically: it loads the event page, selects seats, and checks out faster than a person can, often across many accounts and proxy addresses. Scalpers use them to buy inventory for resale. OWASP catalogs the pattern as OAT-005 Scalping.
Are ticket bots illegal in the US?
Using bots to get around a ticket seller's purchase limits or security measures is illegal under the US BOTS Act, as is reselling tickets obtained that way. The FTC and state attorneys general enforce it. Centinel is a bot-management control; whether a control meets a legal duty is a question for your counsel.
What is seat spinning?
Seat spinning is holding seats in carts with automation so other buyers cannot purchase them, then releasing or buying them later. OWASP files it under OAT-021 Denial of Inventory. It hurts an on-sale even when the bot never pays.
Is Centinel a virtual waiting room?
No. A waiting room controls how many visitors enter at once; Centinel evaluates how each request was made. The two work together: scripted sessions can be challenged or blocked on the routes you choose, including the one that admits a buyer to the queue.
Will fans see a CAPTCHA during the on-sale?
Not by default. A challenge is one response among several, and it applies to requests with weak evidence on the routes you choose. Fans whose sessions look ordinary go straight through.