Shopping Bots for Labubu, Pokémon and Target Drops: How They Work and Why Proxies Show Up

A shopping bot is software that watches a store for a product and tries to complete the purchase far faster than a person can tap through a cart. During limited releases, such as Labubu blind boxes from Pop Mart, Pokémon trading card sets or a Target-exclusive collectible, these programs compete with ordinary fans for a few thousand units, and many of the items end up on resale sites at several times the sticker price.

This overview is written for three audiences: collectors wondering why a drop sold out in seconds, small sellers who resell or run their own shops, and retailers planning a launch. It explains what these bots are, why their operators route traffic through proxies, which defences stores use, where the legal lines run and how to buy a limited item fairly. It is not a setup guide, and it does not recommend any bot software.

What Counts as a Shopping Bot

The term covers several very different tools, and mixing them up causes confusion:

• Stock monitors. Scripts that poll a product page or an app feed and send an alert when an item becomes available. Many collectors use public restock alerts built on this idea, and most stores tolerate light monitoring.
• Checkout bots. Programs that do not stop at an alert: they add the item to the cart, enter saved shipping and payment details and submit the order, often across dozens of parallel sessions. This is the category retailers fight and the one people usually mean by sneaker, ticket or toy bots.
• Commerce assistants. Chatbots on a store website, price comparison tools and wish-list trackers. They also automate shopping tasks, but they work for one buyer at human scale and do not try to beat a queue.

The line that matters is scale and intent. A single alert that tells you a set is back costs the store nothing. A fleet of sessions that clears the inventory before real customers load the page breaks the store's rules and the experience of everyone else.

Why Limited Drops Attract Bots

Bots follow the money, and limited drops create an obvious gap between retail and resale prices. A blind box sold for a modest retail price can go for several times that on marketplaces when a rare variant or a sold-out series is involved. Sealed Pokémon products, such as Elite Trainer Boxes and special collections, behave in a similar way because collectors and investors both chase them.

The hype cycle feeds itself. When a release sells out instantly, prices on secondary markets climb, which makes the next release even more attractive to automated buyers. In 2025 several Pop Mart stores outside China paused in-store Labubu sales after crowds and scuffles, which shows that the pressure reaches physical shops too, not only websites.

How Checkout Bots Operate, in Broad Terms

At a conceptual level, a checkout bot automates the same chain a human follows, only without waiting for pages to render or for a person to read them. It learns that stock exists, reserves it in a cart, passes whatever checks the store presents and confirms payment. The speed advantage comes from three things: requests are sent the moment a product goes live, form fields are filled instantly from stored profiles, and many attempts run at once.

That last point is where stores and bot operators collide. A retailer that allows two units per customer has no problem with one fast shopper. It does have a problem with one operator who looks like two hundred shoppers. Most anti-bot work on the retail side is about spotting that a crowd of buyers is really one actor.

Why Bot Operators Use Proxies

A proxy server passes requests on behalf of the client, so the store sees the proxy's IP address instead of the real one. For someone running many checkout sessions, this matters for a simple reason: retailers count requests, carts and orders per IP address, and hundreds of attempts from one home connection get throttled or blocked quickly.

Operators therefore spread their traffic across many addresses. Residential IPs, which belong to ordinary home internet connections, are popular because they resemble real customers more than server addresses do; our explainer on what residential proxies are covers how that type differs from datacenter IPs. Rotation, where each session or request leaves from a fresh address, is the other common pattern, and the general mechanics are described in the article on rotating proxies.

Two caveats are worth stating plainly. First, an IP address is only one of many signals: stores also look at device and browser fingerprints, behaviour on the page, payment cards, shipping addresses and account history, as the overview of how websites detect bots explains. Second, using a proxy does not change the rules of the store. Proxies have plenty of ordinary uses, from privacy to testing and research, but routing a bot through them does not make the bot permitted.

How Retailers Detect and Limit Bots

Stores rarely depend on one barrier. They layer several measures so that a bot clearing one still trips another.

Virtual Queues and Waiting Rooms

During a big release, a store may send every visitor into a waiting room and let them in at random or in order of arrival. Pokémon Center has used this approach for high-demand products. A queue removes the pure speed advantage, because arriving a fraction of a second earlier no longer guarantees the first cart, and it gives the site time to inspect each visitor before checkout.

Purchase Limits

A limit such as one or two units per customer is enforced against more than the account name. Retailers compare shipping addresses, payment cards, phone numbers, email patterns and device data to link orders that come from the same person. Several big US chains have set purchase limits on trading card products in stores and online.

Verification Steps

CAPTCHAs, one-time codes sent by SMS, mandatory sign-in, paid memberships or loyalty programmes and occasionally ID checks all add friction that costs real customers a few seconds but costs a large bot operation a great deal. Some drops are restricted to members of a store programme for the first hours.

Raffles and Lotteries

A raffle turns a speed contest into a draw. Buyers register during a window, the store removes duplicates and suspicious entries, and winners receive a link to purchase. Pop Mart has used lottery-style registration for access to some in-store Labubu releases, and sneaker brands have relied on draws for years.

Order Review and Cancellations

The final filter comes after the sale. Stores review orders, and those placed through multiple accounts or in breach of the limits get cancelled and refunded. In 2025 Pokémon Center cancelled a wave of Elite Trainer Box pre-orders it believed violated its terms on multiple accounts; reports also showed that some ordinary buyers were caught in the sweep and some orders were reinstated later. False positives are the honest cost of this method.

Rules and Legal Risks

Whether a shopping bot is legal depends on what is bought and where. Store terms are the first layer: nearly every major retailer reserves the right to cancel orders, close accounts and refuse service when automated tools or multiple accounts are used to get around limits. That is a contract issue, not a crime, but the consequences are real, including frozen accounts and lost loyalty balances.

Event tickets are treated more strictly. In the United States, the Better Online Ticket Sales (BOTS) Act of 2016 prohibits circumventing security measures and purchase limits on ticket sites. Enforcement was rare for years, yet in 2025 the Federal Trade Commission sued a ticket reseller group over purchases for a major stadium tour, following a presidential executive order on ticketing. The United Kingdom made the use of software to exceed ticket purchase limits an offence through the Digital Economy Act 2017, and several US states have their own anti-scalping rules.

For toys, cards and general merchandise, no federal US law bans bots outright at the time of writing. Bills such as the Stop Grinch Bots Act have been introduced in Congress more than once but have not been enacted. That gap does not make the activity safe: payment providers may flag the volume, platforms may ban resale listings, and buyers who purchase "bot services" from strangers regularly lose money to scams or download malware disguised as software.

What This Means for Sellers and Retailers

Small resellers depend on marketplace accounts and store accounts. When a retailer links several of them to one person, the result is usually a batch of cancellations and a closed profile, which can wipe out the margin the reseller was counting on.

Retailers, on the other side, balance fairness against friction. A queue, a strict limit per household and a short raffle window protect most launches, while post-sale review handles what slips through. Clear communication matters too: telling customers in advance how a drop will work reduces the feeling that the game is rigged.

Not every automated visit to a store is a scalper. Brands and sellers legitimately track public prices, stock levels and assortment across regions, which is ordinary price monitoring rather than buying. That work also relies on proxies, for example residential proxies to see the prices shoppers in a given country actually get, and the role of such data in pricing decisions is covered in our article on proxies in market analytics. The difference lies in what the traffic does: reading public information at a polite rate versus clearing stock that other people want.

Fair Ways for Buyers to Get Limited Items

You do not need automation to stand a reasonable chance at a drop. A few habits help:

• Follow official channels. Brand apps, newsletters and social accounts announce release windows and rules. For Labubu, Pop Mart's own app has been the main online channel.
• Enter every raffle you qualify for. Draws give a person with one account the same odds as anyone else who follows the rules.
• Use pre-orders and membership windows. They are slower but far less chaotic than a timed drop.
• Check local shops. Independent toy and card stores often allocate stock to regulars or run their own lists.
• Wait out the hype. Popular series are frequently reprinted or restocked, and resale prices tend to fall once supply catches up.
• Avoid paid shortcuts. Sellers of guaranteed checkouts, bot rentals or "cook group" memberships ask you to break store terms and are a common source of fraud.