pokemon-stock-checker/docs/BOT_DETECTION_STRATEGIES.md

# Pokemon Center Bot Detection - Strategies & Solutions

Pokemon Center uses **Imperva (Incapsula)** bot protection, which is one of the most aggressive anti-bot systems. Here are practical approaches to work around it.

## Current Problem
- Direct API calls: **403 Forbidden**
- Sitemap.xml: **Blocked by Imperva**
- Browser automation: **CAPTCHA after a few requests**

---

## Strategy 1: Third-Party Stock Trackers (Easiest)

Instead of scraping Pokemon Center directly, integrate with existing stock tracking services:

### Discord Bots/Webhooks
Several Discord servers track Pokemon Center in real-time:
- **Pokemon TCG Drops** - Dedicated Pokemon TCG stock alerts
- **Stock Informer** - General retail stock tracking
- Search Discord for "Pokemon Center stock alerts"

You can join these servers and set up webhook forwarding to your own Discord.

### Stock Alert Services
- **NowInStock.net** - Has Pokemon Center tracking
- **Distill.io** - Browser extension for change detection
- **Visualping** - Monitors page changes

### Implementation
```python
# Forward alerts from a public tracker to your system
# Set up a Discord bot to listen to stock alert channels
# Then forward to your own notification system
```

---

## Strategy 2: Undetected Chrome Driver

Use `undetected-chromedriver` which patches Chrome to avoid detection:

```bash
pip install undetected-chromedriver
```

```python
import undetected_chromedriver as uc

driver = uc.Chrome(headless=False)  # Headless often gets detected
driver.get("https://www.pokemoncenter.com/category/tcg-cards")

# Add human-like delays
import time
import random
time.sleep(random.uniform(3, 7))

# Scroll like a human
driver.execute_script("window.scrollBy(0, 500)")
time.sleep(random.uniform(1, 3))
```

**Pros:** Often bypasses Imperva
**Cons:** Slower, still may trigger CAPTCHA eventually

---

## Strategy 3: Session Persistence

Keep a browser session alive and logged in:

1. **Manual login once** - Complete any CAPTCHA manually
2. **Save cookies** - Export session cookies
3. **Reuse session** - Load cookies on each check
4. **Longer intervals** - Check every 3-5 minutes instead of 60-90 seconds

```python
# Save cookies after manual login
import pickle
pickle.dump(driver.get_cookies(), open("cookies.pkl", "wb"))

# Load cookies on subsequent runs
cookies = pickle.load(open("cookies.pkl", "rb"))
for cookie in cookies:
    driver.add_cookie(cookie)
```

---

## Strategy 4: Residential Proxy Rotation

Use residential proxies that look like real home internet connections:

### Providers
- **Bright Data** (formerly Luminati) - Best but expensive
- **Oxylabs** - Good quality
- **Smartproxy** - Budget option
- **IPRoyal** - Pay-per-GB

### Cost
- ~$10-15/GB for residential proxies
- ~50-100 requests per MB depending on page size

```python
proxies = {
    "http": "http://user:pass@proxy.provider.com:port",
    "https": "http://user:pass@proxy.provider.com:port"
}
```

---

## Strategy 5: Human-Like Behavior Pattern

If continuing with browser automation:

```python
import random
import time

def human_like_check():
    # Random delay between checks (2-5 minutes)
    delay = random.uniform(120, 300)

    # Random user agents
    user_agents = [
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...",
    ]

    # Vary timing throughout the day
    # Check more during business hours, less at night
    hour = datetime.now().hour
    if 2 <= hour <= 6:  # 2am-6am
        delay *= 2  # Slower at night

    # Add random mouse movements
    # Add random scrolling
    # Occasionally visit other pages (home, about)

    return delay
```

---

## Strategy 6: Webhook from Manual Monitoring

The most reliable approach for Pokemon Center:

1. **Open Pokemon Center in your actual browser**
2. **Use Distill.io browser extension** to monitor changes
3. **Set up webhook** to forward alerts to your system

This way:
- You're using a real browser with real cookies
- Imperva sees normal human behavior
- Change detection triggers your notification system

---

## Recommended Approach

Given Pokemon Center's aggressive protection, I recommend a **hybrid approach**:

1. **Primary: Join existing stock alert Discord servers**
   - Let others deal with the bot detection
   - Forward their alerts to your system

2. **Secondary: Use undetected-chromedriver with long intervals**
   - Check every 3-5 minutes
   - Use session persistence
   - Add human-like behavior

3. **Backup: Manual Distill.io monitoring**
   - For specific products you really care about
   - Most reliable but requires keeping browser open

---

## Code Changes Needed

To implement these strategies, we would need to:

1. Add `undetected-chromedriver` as an option
2. Implement cookie/session persistence
3. Add configurable random delays
4. Add proxy support
5. Consider adding Discord bot listener for third-party alerts

Would you like me to implement any of these strategies?