Humans vs Humans: What do the bots really want?

At CrowdHandler, we've built sophisticated bot-mitigation defenses: anomaly detection, IP filtering, CAPTCHAs, and behavioral analysis. But the more we fight bots, the clearer one thing becomes—there is no silver bullet.

Actually, “bots” aren’t the source of the problem. It sounds obvious, but behind every ticketing exploit, there’s a human. Or more accurately, a network of humans working together in complex ways.

A Funny Question That Changed My Thinking

I was analysing bot activity with a consultant from a major security firm. We looked at logs of automated behavior, such as users scanning availability, scraping layouts, or probing security systems.

The bots had a pattern that didn’t make much sense, so the consultant asked me:

"What do you think they want?"

It was a good point, since the bots we were analysing weren’t even trying to buy tickets. They were collecting data. It was a reminder that bots are part of something much bigger.

Bots are not “Script Kiddies”, but they aren’t AI Masterminds either. 

There’s a popular myth: ticket bots are either crude amateur scripts or hyper-advanced AI capable of breaking any defense.

The reality? Neither. 

What we see in the wild is a much more nuanced—and human—ecosystem. What looks like a single bot is often a coordinated mesh of tools and tactics: scrapers, seat mappers, proxy rotators, account farms, and pricing engines.

Welcome to the Ecosystem

A ticketing bot operation may include:

• Scrapers for pricing and availability

• Seat map explorers to gauge value

• Residential proxies to avoid detection

• Captcha solvers (human and AI-driven)

• Cook groups to share intel and scripts

• Account creators for scale

• Multi-browser bots with unique IPs, credit cards, and shipping addresses

• Resale bots to list captured tickets instantly

Even low-demand events aren’t immune. One of our regional clients in America, who promotes classical concerts, still sees persistent bot traffic. Why? Because their data feeds ticket aggregators. Scalper sites list everything. So, even if they haven’t bought the ticket yet, they can source it once someone clicks "Buy."

Residential Proxies

A major shift came last summer with the widespread adoption of residential proxies.

Instead of coming from data center IPs, bot traffic routes through real consumer ISP addresses. 30–100 million of them are available for rent, and they are indistinguishable from genuine fans. 

Today, 1 in 4 bad bot requests originates from residential ISPs. 

When we block these, we risk locking out real users—fans who are unknowingly using the same networks. It’s a high-stakes balancing act.

The Social Side of Scalping: Cook Groups

“Cook groups” are the core of the human story. 

These are invite-only communities where scalpers swap secrets, post alerts, share “success screenshots,” and sell training. They often operate on Discord or private forums.

It's not necessarily money which motivates members. There’s social currency too—recognition, “bragging rights,” and status. Bots are tools, but the real game behind them is human: it’s about competition, community, and identity.

Like all online pyramids, those at the top make money selling tools, not tickets. Most of the participants—the “chumps” at the bottom—are just trying to belong.

A Legal Grey Zone

In the US and the UK, using bots to buy tickets is illegal. But selling the software? Not necessarily.

This loophole creates a thriving market of tools, services, and how-to guides. Many of the people clogging up your website aren’t professional resellers. They’re hobbyists with a few browser tabs, running subscription-based tools they found on Telegram or Reddit.

Same Tricks, Different Industry

Ticketing isn’t the only target. Botting is mainstream in sneakers, gaming, and electronics. And the methods often overlap.

I once congratulated a fashion exec on avoiding bots during a big sneaker drop—only for him to reveal they’d been botting other brands themselves to stock up. It’s become normalised.

What a Bot Actually Looks Like

Today’s commercial bots offer slick UIs, dashboards, and config tools. Users can:

• Select an event

• Choose quantity, price, and timing

• Load your proxy list

• Spin up hundreds of browser instances

Each browser tab might have a different credit card, address, and IP. It’s a numbers game. More attempts = more wins. The ticketing queue is now a lottery, and the bots are buying every ticket they can.

Make Them Pay to Play

It’s a spending race. Consider this:

• Residential proxies cost more than datacenter IPs

• Real browsers are more expensive to run than headless ones

• CAPTCHA-solving services (AI or human) charge per challenge

Your goal isn’t perfection. It’s to make life more expensive for scalpers. Many of them already have slim margins. Moreover, many of them live in fear of “eating” (not being able to resell the tickets they scrape). Force them to spend more, and many will give up and move on to easier sites. 

What Works and What Doesn’t.

Here’s what doesn’t work:

• Relying only on IP blocks

• Static challenges that bots can learn

• Weak API protection

• Not enforcing post-purchase audits

• Underestimating human collusion

Here’s what might work:

• Putting CAPTCHAs at the start of the journey

• Fingerprinting browser sessions and tracking handoffs

• Enforcing one-purchase-per-IP policies

• Auditing suspicious orders

• Blocking scrapers before the on-sale

• Watching for session behavior anomalies

The Bear Theory of Bot Defense

There’s an old joke:

You don’t have to outrun the bear—just the guy next to you.

Same goes for bots.

You can’t be invincible. But if your site is harder to exploit than your competitors’, the bots will focus their fire elsewhere. That alone can save thousands of tickets for real fans.

No Silver Bullets—But There Is Hope

Although there is no single solution, there are certain measures that you can take:

• Set realistic expectations with stakeholders

• Layer your defenses

• Update your playbook regularly

• Focus on becoming harder, not impossible to exploit

• Celebrate wins, however small

Bots are human tools. To beat them, we have to understand the human motivations behind them.

At CrowdHandler, our mission is to help ticketing professionals level the playing field. By understanding the game, we can change it.

Sign up today for a free trial.