September 14, 2026
How We Caught the Bots Scraping Our Token Deals
Bloxtsar runs a live Token Deals feature for eligible Roblox games like Baddies and Blade Ball: a fast, public feed of the best in-game token deals the moment they appear. One thing worth saying up front, this is not "our" market. The deals happen inside those Roblox games; Bloxtsar simply surfaces them in one place. We built the feed to help traders, and we are genuinely glad when people use the data to trade smarter.
This post is about the line past that: when the same data gets copied at industrial scale, used to hand bots an unfair edge, and turned into bait for stealing people's accounts. We pulled fifteen days of server logs (Aug 30 to Sep 13, 2026, roughly 200 million requests) and went looking. Everything below is aggregated. No individual user is named.
| 15.7M | requests on our busiest day |
| 3.4M | hits on a single deals endpoint in 15 days |
| ~19 in 20 | deals requests came from automated clients |
| Up to 50% | of those requests were already being blocked |
Popular data attracts scrapers
Live token deals are exactly the kind of data other people want to copy in bulk: to feed a competing tool, to snipe the best deals before anyone else, or to stand up a mirror of the feed. Over the last two weeks a coordinated scraping effort did precisely that, and the fingerprints it left behind are unmistakable.
None of this exposed anything a signed-in user cannot already see. What is interesting is the shape of the traffic, because bots, no matter how they dress up, tend to move in ways people never do.
#1: a surge that started on a single day
Requests to our token deals feed sat quietly under 60,000 a day, until September 3, when a new automated client appeared and volume jumped four to six fold overnight. It has stayed there ever since.
The client behind the jump identifies itself as Roblox/WinInet (the HTTP stack a Roblox client uses) and does almost nothing but page through deals, ?page=N&limit=30&sort=newest, over and over, as deep as page 91. Real people open the deals page, glance at the top listings, and move on. They do not quietly request page 91 of "newest" every few minutes for two weeks straight.
#2: bots wear name tags
Every request carries a "user-agent", a short line a browser sends to say what it is. Real browsers send long, specific, consistent strings. The clients hammering our deals feed sent these instead. Roughly 19 out of every 20 requests to that endpoint came from something on this list.
| User-agent | What it really is |
|---|---|
Roblox/WinInet | A Roblox client's raw HTTP stack. The single largest source of deals requests, and the cause of the Sep 3 surge. |
Python/3.14 aiohttp/3.14.3 | An async Python script. It does not even pretend to be a browser. |
Mozilla/5.0 | A browser string with everything after "Mozilla/5.0" stripped off. No platform, no engine, a script wearing half a name tag. |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | A Chrome string with the "Chrome/..." cut off. Real Chrome never looks like this. It is a headless automation tool. |
Mozilla/5.0 (Macintosh...) AppleWebKit/605.1.15 (KHTML, like Gecko) | Safari's string with the "Version/... Safari/..." ending missing, the fingerprint of a scripted, headless browser engine. |
BaddiesTradeMarketBot/1.0 | A bot that politely introduces itself. It has been pulling our trade ads every day for as long as we have logs. |
#3: the data gets weaponized
Copying data is not the real problem. What that data enables is.
The mildest version is automated sniping. Bots watch the "newest" feed and claim the best underpriced deals the instant they appear, faster than any person clicking a mouse, so the listings the feature exists to surface get taken before real users ever see them. There is no trick to it and nothing is asked of anyone; the bot simply reads the feed and acts first.
The darker version is outright fraud. We have also seen our deals data used as bait, repackaged into scripts that promise to display Bloxtsar's item values and token values right inside the in-game trading window, and handed out for popular executors like Delta. In reality they are scam scripts with a keylogger injected in: run one and it silently records what you type and lifts your in-game trading PIN. From there it is used to take over your Roblox account and clear out your items, and when the account is not the goal, to scam you inside the trade itself, with freeze scams that lock the window on a doctored view or a last-second item swap that changes what is on the table the instant before you confirm.
The keylogged PINs, together with a link to the server their target is currently in, then get posted into private "snipe" channels for others to pounce on.
If you ever see a script claiming to bring Bloxtsar deals into a Roblox game, do not run it. We do not distribute executor scripts, and we will never ask for your PIN.
The sellers, and why the profile pages took a beating
Every deal names the player selling it, and a mirror of the market is only useful if it knows who those sellers are. To attach that identity to each listing, the same operation also hammered our public player profile pages, the /@ pages, pulling each seller's Roblox information one profile at a time. That is a second stream of automated load stacked on top of the deals feed itself.
There was a quieter way to get that data. We offer the same seller information through an interface that is only available to signed-in accounts. The scrapers avoided it, almost certainly because it required an account, and chose to harvest the public profile pages instead. Ironically, had they gone through the signed-in route at that volume, the strain on our systems might have been even worse. Either way, the profile harvesting piled yet more weight onto an already stretched service.
Rate limits, and how they slipped past
We were not defenseless. Our deals feed enforces rate limits: signed-out requests are capped at ten every fifteen seconds, and signed-in accounts at fifty. Anything past that is refused, and on the busiest days up to half of all automated requests to the endpoint were turned away outright.
The catch is that a rate limit is counted per source, and this was not one source. Rather than hammering from a single address, the operation spread its requests across a rotating pool of many addresses, each sitting just under the limit while the pool as a whole still pulled hundreds of thousands of requests a day. Distributed like that, a rate limit slows a determined scraper down but does not stop it. That is the gap a challenge closes, and rate limits cannot.
The cost you may have felt: it made the site slower
This traffic was not free. At its peak it stacked onto our busiest hours and competed with real users for the same servers, and the timing is hard to ignore: the slowdowns line up with the exact day the automated traffic began.
We did not have to guess. The developer behind one of the community's private trading bots, the one whose requests identify as BaddiesTradeMarketBot/1.0, told us the site had become noticeably slower, and that they had noticed it before we migrated Bloxtsar from a monolith to a monorepo. That detail matters: it rules out our own re-architecture as the cause and points squarely at the surge in automated traffic.
We take that seriously. A faster site for everyone is a large part of why removing this traffic mattered, not just the principle of it.
How we stopped most of it
The turning point was human verification. We now put an interactive challenge in front of the paths that were being abused, the kind a real browser clears in the background without you noticing, but that an automated client cannot pass. Scrapers depend on never having a human in the loop, so a challenge they cannot solve cuts off the bulk of the traffic at once. Since we turned it on, most of the automated scraping has stopped.
That sits on top of the defenses that were already there:
- Rate limits that bite. Already turning away 40 to 50 percent of automated requests. The bots hit the ceiling, real users never notice it.
- Reading behavior, not labels. Disguised user-agents and inhuman request rates give a bot away no matter what it claims to be. We watch how clients act, not what they call themselves, and cut off the obvious offenders at the edge.
Scraping public data is an arms race every popular site runs, and we are happy to run it. The deals are real, the data is fresh, and the most reliable place to track it lives here, on Bloxtsar. To anyone still paging through "newest" at 3 a.m.: the challenge page says hi.