Protect fares, seat inventory, and loyalty accounts from travel bots
Airlines, hotels, and online travel agencies publish live prices and availability, and often pay to answer each search. Centinel evaluates how each search, hold, and login request was made. Travellers and approved partners keep access, and scrapers get the response your policy sets.
Request a site auditEach search costs money, and scraped searches rarely book
A fare or availability search often calls a pricing engine or a distribution system that charges for the query. Scrapers repeat those searches across many routes and dates, so the cost of each real booking rises. Blocking all automation also blocks metasearch sites and approved agencies, which need the same data.
Read the analysisWhat the traffic looks like
Fares and availability, scraped
Competitors, resellers, and unapproved aggregators rerun fare and room searches across routes and dates. Each booking then carries more searches.
Seats and rooms held without payment
Scripts start bookings to hold inventory and then let the holds expire. OWASP lists flight seats as a target of OAT-021 Denial of Inventory.
Points and miles as a target
Loyalty balances can be spent like money, so loyalty logins attract credential stuffing. Attackers drain taken-over accounts through redemptions.
What runs against this traffic
Evidence on search and availability routes
In supported browser deployments, Centinel evaluates request and browser evidence on fare, availability, and room searches instead of relying on one IP address or header.
Teams can rate-limit or challenge a scraping session before its searches reach the pricing engine, without adding friction for travellers.
Read more: Evidence on search and availability routesA separate policy for holds and bookings
Booking-start and hold routes can carry their own response, separate from the policy for searching.
Teams can rate-limit or challenge repeated scripted holds. Hold times and fare rules stay in your reservation system.
Read more: A separate policy for holds and bookingsA login policy for loyalty accounts
Where the integration supports it, loyalty and account logins can be observed, rate-limited, challenged, or blocked by how they were made.
Teams can add friction to credential stuffing against point balances. Centinel does not decide whether a login or a redemption is fraudulent.
Read more: A login policy for loyalty accountsKeep metasearch and approved partners
Centinel can compare a declared crawler identity with the verification data its operator publishes, and known partners can keep an explicit policy.
Metasearch partners, agencies, and search crawlers keep their access. A scraper that copies a partner's name gets no trust from the name alone.
Read more: Keep metasearch and approved partners
See what reaches your site
Start with a free scraping audit. A person reviews the scraping test results, then emails you the exposed pages and fixes to consider. The audit covers scraping exposure only, not every abuse pattern or all production traffic. Discuss broader coverage in a demo.
Travel and airlines: common questions
What platform and security teams ask before they deploy.
What is fare scraping?
Fare scraping is the automated collection of prices and availability from an airline, hotel, or travel agency's search results. Competitors, resellers, and unapproved aggregators run it across many routes and dates, often through rotating proxies.
What is the look-to-book ratio?
The look-to-book ratio is the number of searches a travel seller answers for each booking it makes. Scraping raises it, because automated searches almost never book. Where each search has a cost, a higher ratio means a higher cost per booking.
What is seat spinning in airline booking?
Seat spinning is holding seats with automation, by starting bookings and letting them expire, so other travellers cannot buy them. OWASP files it under OAT-021 Denial of Inventory. It can make a flight look sold out when it is not.
Can an airline block scrapers and keep metasearch partners?
Yes. Partners and search crawlers can keep an explicit policy, based on their published verification data or on credentials your API already checks. Centinel evaluates every other request on search routes by how it was made.
How do bots steal loyalty points?
Often through credential stuffing. Scripts replay leaked username and password pairs against the loyalty login, then redeem or transfer the points in the accounts they get into. The defence starts at the login, where the automation is visible.