The Reseller Bot Supply Chain: Cook Groups, Proxies, and Stolen Accounts

The parts list, with prices

Start with the bot itself. Tools like AIO Bot, Cybersole, Wrath, Stellar AIO, and Soleslayer cost $200 to $1,200 a year, and the license is the cheapest part of the operation. The bot does two things: it checks out faster than a human, and it dodges the defenses a marketplace put up last time. Everything else in the stack exists to keep the bot's sessions looking like separate people.

Next come the proxies. Each checkout attempt needs its own residential IP, rented from networks like BrightData, Smartproxy, IPRoyal, or NetNut. From a marketplace's access logs, every request then looks like a different home internet user, and a per-IP rate limit blocks nobody. Antidetect browsers such as Kameleo or GoLogin give each session its own canvas hash, WebGL renderer, and timezone on top of that. The fingerprint matching a marketplace relies on stops working when every session carries a fresh one.

Then the accounts. Bot operators farm aged accounts months before a drop, because a new account with no history trips every trust check a marketplace runs. New seller accounts are the weak point for exactly this reason: a blank slate is easy to create and hard to trust. Farmed accounts solve that problem by arriving with history attached.

Where the drop details come from

The information layer is the cook group. Operators pay a monthly fee to join a Discord community that hands them drop timing, product URLs, and tips for getting past the current defenses. The bot developers run some of these groups themselves, and the better groups share monitor alerts the second a listing goes live. A monitor bot watches the target pages around the clock, so the human operator never has to sit and refresh.

This is why a drop sells out in 90 seconds. A single operator queues 200 to 2,000 tasks against one product URL, and at the second the drop opens, every task tries to check out at once. List 1,000 units and one operator with 2,000 tasks takes 30 to 60 percent of the inventory. The buyers who lose out are not slower. They are outnumbered by a factor of two.

What actually raises the operator's cost

CAPTCHAs do not. A reCAPTCHA v2 solve costs about $0.0006 and takes nine seconds through a solving service, so an operator chasing a $400 item resold at $1,200 can spend six cents per attempt and still clear a profit. A CAPTCHA at checkout is a tax on real buyers, not a wall against bots.

What raises cost is tying the purchase to something the operator cannot rent in bulk. A queue that holds each session and releases inventory in small waves forces the operator to keep thousands of sessions alive at once, which costs proxy bandwidth by the minute. A purchase limit tied to a payment instrument rather than an account forces the operator to find fresh cards, not fresh usernames. And a checkout that checks the billing address against the account history makes a farmed account worth less the moment it tries to pay. None of these stops a determined operator. Each one changes the math on whether the run pays.

The tell in your own numbers

Look at who buys, not how fast the stock moves. A drop where 40 percent of checkouts used a different card for every order, where shipping addresses cluster into a handful of freight forwarders, or where the same device fingerprint appears across dozens of accounts is a reseller run, not demand. The payout freeze that follows a bot attack is the marketplace protecting itself after the fact. The numbers above let you see it while the stock is still on the shelf.