The raffle was supposed to end the sneaker bot problem. First-come-first-served drops crashed websites, rewarded whoever hit the checkout endpoint fastest, and handed the whole release to whoever ran the most tasks. Raffles fixed the speed race by randomizing entries and stretching the window to hours instead of minutes. What they did not fix is the incentive. A raffle bot is a bot designed to make as many raffle entries as possible, and since raffles are free to enter, more entries cost the operator nothing and improve the odds the same way extra lottery tickets do. Nike reports that raffle bots and bot attacks make up between 10 and 50 percent of all entries to its raffles, and it removes up to 12 billion bot attempts monthly while conceding that a small fraction of bot entries may still succeed on any given launch. With the global sneaker resale market estimated at 10 billion dollars, the arithmetic behind that fraction is the whole story.
Nike's SNKRS system shows what serious raffle defense looks like, and it is not a CAPTCHA at the front door. The platform runs two draw formats: LEO, Let Everyone Order, a 2-to-3 minute invisible queue window, and DAN, a 10-minute randomized draw with a visible countdown. Both exist to give machine-learning filters an inspection buffer. Instead of blocking suspicious connections at login, the platform accepts draw submissions silently, then scrubs flagged entries from the eligible pool before randomized allocation begins. That silent filtering prevents script operators from testing bypasses in real time. Behavioral biometrics feed the scoring: touch pressure, scroll timing, zero-millisecond form fills, identical clicks. An entry that fills a form in zero milliseconds is marked ineligible before the raffle draw, and the account is never notified. It just never wins.
What works against a lottery is account quality and account volume. A serious operation runs anywhere from 50 to 500 SNKRS accounts in parallel, each needing its own email, payment method, shipping address, device fingerprint, and network identity. Two accounts logging in from the same IP within an hour both get flagged. Two accounts with the same browser canvas hash get clustered and disqualified silently. Datacenter IP ranges from AWS, Google Cloud, and DigitalOcean were burned years ago: Nike, Adidas, and Shopify all maintain shared blocklists, and any account that touches one gets soft-banned. Residential proxies extended the life of botting for a while, but the better anti-bot vendors, PerimeterX, Akamai Bot Manager, Kasada, learned to score them down too. Mobile IP ranges are the last clean address space at scale, because carrier-grade NAT puts thousands of real phone users on Verizon, T-Mobile, or Vodafone behind the same outbound IP at any moment. Tasks running on mobile IPs check out at roughly 3 to 5 times the rate of the same tasks on residential IPs, on heavily protected sites.
The countermeasures that actually work are the ones that attack volume at its root. Raffle bots can be stopped by identifying repeat addresses, credit card numbers, or email addresses, since one person can only have one of each, but the operators have workarounds: rolling credit card numbers, multiple PO boxes, and fake names and email addresses in bulk. Nike rolled out device check in late 2024, forcing a fresh attestation token from the SNKRS app itself, which broke a generation of API-based bots. The lesson for any retailer running a drop is that the raffle did not remove the bot problem, it moved it from speed to identity. A first-come-first-served drop tests who is fastest. A raffle tests who is most numerous. Defending the second means scoring identity, not latency, and accepting that some fraction of bot entries will always get through, because the filter has to let real customers in too.
Keep reading: The FTC Fake Review Rule, Two Years In: What It Bans and What It Has Done, Credential Stuffing: Your Old Password Is the Attack, and The FTC Click-to-Cancel Rule Is Dead. The Obligations Are Not cover the nearby cases in this series.
No. Raffles removed the speed race, but raffle bots optimize for volume instead: more entries, more accounts, more chances. Nike reports bot attacks make up 10 to 50 percent of entries on hyped releases, and it filters about 12 billion bot requests a month.
It accepts draw submissions silently, then scrubs flagged entries from the eligible pool before randomized allocation, using machine-learning scoring on behavioral biometrics like touch pressure, scroll timing, and form-fill speed. The LEO format gives a 2-to-3 minute window and the DAN draw gives 10 minutes, both as an inspection buffer.
Because a raffle is a lottery, and more entries mean better odds. A serious operation runs 50 to 500 accounts in parallel, each with its own email, payment method, shipping address, device fingerprint, and network identity, since two accounts sharing an IP or a browser canvas hash get clustered and disqualified.
The US Federal Trade Commission's BOTS Act guidance concerns tickets to covered public events: the law prohibits circumventing a ticket issuer's security measures or purchasing rules. It does not cover sneaker releases, which rely on the retailer's own anti-bot stack instead.