Every hour, hundreds of “customers” were shopping. None of them were buying.
A veteran-founded apparel brand that turns donated military materials into everyday goods, with a share of profits going to veteran-chosen charities every month, doesn’t run ads. It doesn’t need to. The owner posts new products on Instagram to a tight-knit following of loyal customers. And that’s the whole funnel. He posts and the shopping starts. He’s close enough to his customers that he gives out his own cell phone number.
That closeness is what surfaced the problem. Customers started texting and DM’ing him directly: “Just tried to grab the new drop — it’s already sold out.” But he wasn’t seeing the checkouts or the revenue to match. Products were flipping to “sold out” within minutes of posting, with no orders behind them.
GA4 showed traffic. It couldn’t explain why none of it was converting, or why inventory kept vanishing without a sale. The site already had a firewall in place. But the traffic hitting it during a drop was sophisticated enough to look like an ordinary human shopper, so it walked right through security without tripping anything. The team stopped posting new products altogether. Not because customers weren’t interested, but because they couldn’t tell real demand from whatever was draining inventory before anyone real got a chance to buy. Every unsold item was also a dollar not reaching the veterans the brand exists to support.
What was actually happening
GA4 counts sessions. It doesn’t classify who’s behind them. So when BotLens went in, the picture changed fast: a wave of automated cart-abuse traffic was hitting the site the moment a new product went live on Instagram, quietly manufacturing fake scarcity. Carts full of phantom inventory, real customers hitting “sold out” on products that were never actually gone.
BotLens classified the traffic, fed the bad actors’ fingerprints back to the brand’s existing security stack to train it to close the gap, and stood up an AI Gateway so legitimate AI shopping assistants could keep browsing and buying safely — instead of getting lumped in with the bots doing the damage.
Better results 20 days later
- 58,392 tracked GA4 events, now classified
- 99.97% verified human traffic
- 1,331,384 requests used to train the brand’s existing firewall and teaching it to recognize the bad-bot traffic it was letting straight through
- 71,279 requests from bad bots blocked by that newly-trained firewall
- Legitimate AI shopping agents now redirected into a dedicated AI Gateway, instead of being lumped in with the bots
- New product drops back on Instagram with confidence
- Monthly recurring revenue recovered above where it stood before
The brand didn’t need a bigger following or a new posting strategy. They needed to know who was actually showing up the moment a product went live. Once they knew that, the drops worked the way they always should have — real customers getting real products.
The takeaway
If your customers are texting you that something’s sold out, but your revenue doesn’t reflect it, that’s not a demand problem. It’s a visibility problem. GA4 will keep telling you “traffic is traffic” until something like BotLens shows you what’s actually in it.
Start with a free 30-day audit. Full traffic classification, the same reports that surfaced this, commitment to buy until day 31. Cancel anytime before that at no cost.