Grinch bots are scripts that rush limited holiday stock, buy it automatically, and leave ordinary shoppers with empty shelves.
They are scalpers aimed at seasonal drops, not general store bookkeeping tools, and the harm is lost stock plus inflated resale prices.
How it works
When a toy, console, or ticket batch goes on sale, the scripts move faster than a person can type a shipping address.
Inventory disappears in seconds, and the same goods often reappear later at a higher price on a resale listing.
The name points at holiday shopping, yet the same pattern appears whenever a small batch is sold to whoever finishes checkout first.
Shops feel the damage as angry customers, failed checkouts, and support load, even when the payment itself was technically completed.
Concrete examples
- A console release sells out in under a minute and identical units appear that afternoon on a resale site at twice the price.
- A toy drop limited to one per household is bought by dozens of orders that share automated timing and then different resale accounts.
- A charity merch sale meant for fans is emptied before the email announcement has even finished loading for most readers.
Protective measures
- Limit quantities per customer, per payment instrument, and per delivery address during short sales.
- Hold scarce inventory until the buyer has passed checks that a raw script finds expensive to repeat.
- Watch for many checkouts that share timing, browser traits, or payment patterns during a drop.
- Give human shoppers a fair window and publish what you will do with orders that break the stated limits.
How CDPCaptcha helps
A browser proof of work challenge raises the cost of holiday scalping scripts because each automated checkout must finish extra computation before it can continue.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.
Related articles
A windowless browser often used to drive this kind of scripted shopping is described in What is headless Chrome in browser automation without a window?.
Checkout abuse that moves money without genuine payer intent is covered in What is payment fraud in cards, transfers, and checkout flows?.
Wider deception against internet shops and accounts is explained in What is online fraud carried out through internet services?.