How do bot farms rotate IP addresses to dodge rate limits?

Where the IPs come from

A serious bot farm does not run on a rack of servers in one data center. It rents access to residential proxy networks, where traffic exits through real home connections, or routes through mobile carrier NAT pools shared by thousands of legitimate phones. Some farms also use compromised IoT devices. The result is a pool of source addresses that look ordinary: consumer ISPs, normal geolocation, no data-center ASN to block.

Rotation is handled by the proxy provider. The farm's scripts request a new exit IP every few requests, or on a timer, and the provider hands them a fresh residential address. A single scraping job against your marketplace can touch ten thousand distinct IPs in a day without any one of them behaving suspiciously.

Why per-IP limits miss them

Rate limiting answers one question: is this address making too many requests? Against a rotating farm, the answer is always no. Each IP stays well under the threshold, request headers rotate with the IP, and the traffic is paced to mimic browsing. The farm also distributes work across time, so there is no sharp spike to catch.

Worse, aggressive per-IP limits start hurting real users. Carrier-grade NAT means one mobile IP can represent hundreds of genuine shoppers. Tighten the limit and you throttle customers; loosen it and the farm walks through.

What actually works

The fix is to stop scoring the IP and start scoring the session. Device and browser signals, navigation patterns, and timing between actions are much harder to rotate than an address. A farm can buy ten thousand IPs, but making ten thousand sessions behave like ten thousand distinct humans is expensive.

Practical layers that hold up: fingerprint sessions across IP changes so rotation does not reset the score, challenge progressively instead of blocking outright so false positives cost a puzzle rather than a lost customer, and maintain shared intelligence on proxy ASNs and known farm infrastructure. Rate limits stay in the stack, but they guard the door against the crude bots while behavioral scoring handles the professionals.

A note for marketplace teams

If your scrape volume did not drop after you tightened rate limits, that is the expected outcome, not a misconfiguration. The farm noticed, rotated, and kept going. The signal that matters is session-level: accounts and devices that keep reappearing under new IPs are the ones to score, challenge, and block.