The weekend that makes or breaks a retail year is also the weekend bot operators plan for months in advance. Scalpers time their scripts to the second a drop goes live. Carding crews test stolen numbers in bursts, hoping a fraction authorize before anyone notices. Inventory abusers sit on stock they never intend to buy. None of this looks like a dramatic outage. It looks like sellouts that never ship, a checkout that feels sluggish, and support tickets about items that vanished from a cart. A real-time monitoring plan turns those quiet distortions into a page someone can act on.

Start With a Baseline, Not a Blocklist

Two to three weeks before your first big sale, spend four or five normal days measuring what healthy traffic looks like. You are not hunting bots yet. You are building the reference numbers that every alert will be compared against.

Capture, broken out by endpoint, and segmented by geography, network owner, device type, and login state:

• Requests per second to search, product, cart, and checkout routes
• Add-to-cart actions per session and per account
• Login attempts and the failure ratio
• New account creation rate
• Checkout completion rate and authorization decline rate
• Average cart hold duration before payment

Write down your real drop times too, including the ones marketing has not announced publicly. A threshold derived from a clean week will beat a generic blocklist every time, because it knows what your store normally does at 9:40 on a Tuesday.

Signals Worth Watching in Real Time

You cannot watch everything. These six signals cover most of what goes wrong during peak, and each one maps to a decision you can actually make mid-shift.

• Add-to-cart velocity per session. A human browsing a sale adds items slowly and unevenly. A scalper script grabs a dozen SKUs in seconds with almost identical timing. Watch the outliers, not the average.
• Checkout attempts per card range or email domain. Carding shows up as clusters of low-value authorization attempts with a high decline ratio, often cycling through the same payment page path.
• New account creation with disposable email domains. A small baseline is normal. A curve that bends upward during a drop usually means someone is stockpiling accounts for a launch.
• Inventory held but never paid for. If reserved units climb while completed orders stay flat, you are being strangled by carts rather than outbid by buyers.
• Timing regularity. Requests arriving at fixed intervals, or with suspiciously consistent gaps, are rarely human. Humans are jittery.
• Search and listing enumeration. Spikes on category pages with high 404 rates usually mean scraping, often a precursor to a coordinated buying run.

Keep a canary in place: one unpopular SKU with a hidden page and a normal-looking price. If it starts receiving traffic during a drop, you have proof of automated enumeration rather than a theory.

Turn Thresholds Into Pages, Not Dashboards

A dashboard nobody watches at 2 a.m. is decoration. Build two tiers instead. Warnings go to a shared channel and can wait. Pages go to whoever is on call and must include three things: what changed, which endpoint or segment is affected, and the first action to take.

Set thresholds against your baseline, not against fixed numbers. "Add-to-cart from a single network owner exceeds three times its normal share for three consecutive minutes" is actionable. "Traffic is high" is noise. Some practical rules:

1. Every alert has a named owner before the sale starts.
2. Every alert has a first action written next to it, even if that action is "check the payment processor status page."
3. Suppress alerts during announced marketing pushes, and tell the paid media team your schedule so you are not paging yourself over your own ads.
4. Review warning-level alerts daily during the peak week and delete the ones that never earned attention.

Runbooks for the Three Attacks Retail Sees Most

Scalper bots

Confirm before you block. Check whether the traffic passes your JavaScript challenge, whether sessions share fingerprints, and whether the same accounts keep appearing. Then respond narrowly: tighter rate limits on the affected route, queue tokens for high-demand items, or short inventory holds that expire quickly. Avoid blanket bans on large network ranges. Retail traffic often shares address space with ordinary customers, and a wide ban can cost you more revenue than the bot ever did.

Carding attacks

Watch decline ratios per session cluster rather than per single IP, because distributed testing hides behind rotating addresses. When a cluster spikes, add friction to the payment step for that traffic only: step-up verification, a challenge, or a brief delay. Talk to your payment processor before making sweeping changes, and keep a record of what you altered and when. Friction applied broadly is how you lose legitimate buyers on your biggest day.

Inventory abuse

This includes carts that hold stock without paying, coupon enumeration, and reseller patterns that buy in bulk through many accounts. Tighten hold timers during peak, cap quantity per account and per household signal, and require a verified account for the most limited SKUs. If you use a waiting room, monitor token reuse; a token shared across dozens of sessions means the queue is being gamed.

Staff It Like a Shift

During drop windows, two people minimum: one watching telemetry, one with the authority to change rules immediately. Give them a single incident channel and a handoff note that takes three lines to write — what changed, what we did, what to watch next. Rehearse one runbook before the sale. The first time a team executes a mitigation should not be on Black Friday.

Finally, make every defense reversible. Any rule you deploy needs a kill switch that takes seconds to trigger, and someone must be watching false positives: support contacts, abandoned checkout rate, and complaints about blocked payments. Test your rules against a synthetic buyer journey each morning so you know a normal customer can still check out.

After the Weekend, Keep the Good Parts

The Monday debrief matters more than the sale-day heroics. Pull the alerts that fired and separate the ones that caught something real from the ones that only made noise. Save the fingerprints, thresholds, and rules that worked, and note the ones that blocked good customers so nobody redeploys them next month.

Leave your canaries running through the returns period and January promotions. Bot activity does not stop when the banners come down; it just gets quieter and more patient. The teams that handle peak best are usually the ones that treated monitoring as a season-long habit rather than a weekend sprint.

Photo: Andrea Piacquadio / Pexels