Attack pattern
Seat Spinning: The Bot Attack That Empties Your Cart Without Ever Buying
Bots hold the same inventory in a pending state, let it expire, and repeat — creating scarcity without ever buying anything.
Field notes
Follow the money. Catch the bot.
Bot-driven fraud in e-commerce and online travel, and how AI is reshaping both the attacks and the defenses. One brief a week, sources attached.
Live signal · anon-4471
POST /cart/hold 200 ua=Chrome/126 score=0.12
POST /cart/hold 200 ua=Chrome/126 score=0.11
GET /seat/avail 200 ua=Chrome/126 score=0.14
POST /cart/hold 200 ua=Chrome/126 score=0.13
DELETE /cart/hold 204 ua=Chrome/126 score=0.12Illustrative trace pattern — not customer data.
This week's headline attack
40%
of internet traffic was bad bots in 2025, up 3 points YoY (Thales/Imperva 2026 Bad Bot Report)
53%
of all internet traffic combined, good and bad bots (Thales/Imperva 2026 Bad Bot Report)
24%
of isolated retail security incidents are attributed to business-logic abuse — the category seat spinning and denial-of-inventory fall under (Thales/Imperva 2026 Bad Bot Report)
More this week
AI analysis
The Booking Wasn't Human: How AI Shopping Agents Are Becoming OTAs' New Scraping Problem
The visitor comparing your fares might not be a scraper, and it might not be a human either — it might be an AI agent acting on a traveler's behalf.
Defense
The Bot Check You Never See: How Behavioral Biometrics Score You Before Any CAPTCHA Loads
Many bot-detection systems score whether you're human from mouse movement and typing rhythm, before any CAPTCHA ever loads.