Detect scalper bots and scripted buying at the ticket on-sale
Demand for a big event peaks in the first minutes of the on-sale, and the bots arrive with it. Centinel evaluates how each request to the event, seat, and checkout pages was made. Fans with ordinary sessions go through, and scripted buyers get the response your policy sets.
Request a site auditBots and fans arrive in the same minutes
Scripts refresh the event page, hold seats in carts, and check out across many accounts. They arrive in the same minutes as the fans, on the same routes. A rule that slows every visitor during the on-sale also slows the fans it should protect. The response has to depend on how each request was made.
Read the analysisWhat the traffic looks like
Buying faster than a person can
Scalper bots (OWASP OAT-005) load the event page, pick seats, and pay the moment inventory opens, then list the tickets for resale.
Seats held, never bought
Seat-spinning scripts put seats in carts over and over so no one else can buy them. OWASP files this under OAT-021 Denial of Inventory.
Purchase limits split across accounts
A per-account ticket limit stops one account, not one operator. Scripts register fan accounts in bulk, or take over existing ones, to buy past the limit.
What runs against this traffic
Evidence on event, seat, and checkout routes
In supported browser deployments, Centinel evaluates request and browser evidence on the event page, seat selection, and checkout.
Teams can challenge or block scripted buying, and fans with ordinary sessions can pass without an extra step. Centinel is not a waiting room and does not set purchase limits.
Read more: Evidence on event, seat, and checkout routesA separate policy for seat holds
Seat-hold and add-to-cart routes can carry their own response, separate from the policy for browsing the event page.
Teams can rate-limit or challenge repeated scripted holds before they take inventory off sale. Hold times and cart rules stay in your ticketing system.
Read more: A separate policy for seat holdsEvidence around fan sign-up
In supported sign-up flows, Centinel evaluates the session around account creation, not only the submitted details.
Accounts opened in bulk before an on-sale can be challenged or reviewed. Centinel does not verify who a fan is.
Read more: Evidence around fan sign-upA login policy for accounts that hold tickets
Where the integration supports it, login attempts can be observed, rate-limited, challenged, or blocked by how they were made.
Teams can add friction to credential stuffing against accounts that hold tickets. Centinel does not decide whether a password was stolen.
Read more: A login policy for accounts that hold tickets
See what reaches your site
Start with a free scraping audit. A person reviews the scraping test results, then emails you the exposed pages and fixes to consider. The audit covers scraping exposure only, not every abuse pattern or all production traffic. Discuss broader coverage in a demo.
Ticketing and live events: common questions
What platform and security teams ask before they deploy.
What is a ticket bot?
A ticket bot is a script that buys event tickets automatically. It loads the event page, selects seats, and checks out faster than a person can, often across many accounts and proxy addresses. Scalpers use ticket bots to buy inventory for resale. OWASP catalogues the pattern as OAT-005 Scalping.
Are ticket bots illegal in the US?
Using bots to get around a ticket seller's purchase limits or security measures is illegal under the US BOTS Act, as is reselling tickets obtained that way. The FTC and state attorneys general enforce it. Centinel is a bot-management control; whether a control meets a legal duty is a question for your counsel.
What is seat spinning?
Seat spinning is holding seats in carts with automation so other buyers cannot purchase them, then releasing or buying them later. OWASP files it under OAT-021 Denial of Inventory. It reduces the inventory fans can buy, even when the bot never pays.
Is Centinel a virtual waiting room?
No. A waiting room controls how many visitors enter at once. Centinel evaluates how each request was made. You can use both: Centinel can challenge or block scripted sessions on the routes you choose, including the route that admits a buyer to the queue.
Will fans see a CAPTCHA during the on-sale?
Not at the normal protection level. A challenge is one response among several, and at that level it applies only to suspicious requests on the routes you choose. Fans whose sessions look ordinary go straight through.