Hype drop bot mitigation, how do you stop bots winning Charizards and sealed Booster Boxes?

The classic TCG-drop attack: 8,000 collectors and 200 bots hit refresh at drop time, the bots add-to-cart in 80ms, the collectors get the “sold out” screen, the bots flip on eBay for 2× markup. The mitigation stack I ship:

• Cloudflare Turnstile at the add-to-cart step, replaces reCAPTCHA (which Google is deprecating). Privacy-friendly, no user friction in 95% of cases, blocks headless-browser bots cleanly.
• IP-velocity throttling via Cloudflare WAF rules, max N requests per IP per second to /checkout/cart/add. Tunable per drop. Tighten before chase drops, loosen for everyday sealed product.
• 1-per-customer enforcement by email + shipping fingerprint + payment-vault token. A Magento custom guard module enforces this at the order-placement step, not just at add-to-cart. Bots cycle emails but get caught by shipping-address + card-token matching.
• Stock reservations at add-to-cart (native Magento 2.4+), 15-minute cart timeout to release unconverted reservations.
• Optional raffle mode, for the chase items (PSA 10 Charizard, Black Lotus Beta, sealed Vintage), switch to a 1-hour entry window, pick one winner, refund losers via store credit. Eliminates the bot-vs-collector arms race entirely.

Pre-warm Hyvä + Cloudflare cache 30 minutes before the drop. War room for the first launch. I’ve shipped 40+ TCG drops on this stack with zero meaningful bot wins.