Tools: Solved: Large Competitor Just Ordered My Products – What To Do?

Posted on Feb 11

• Originally published at wp.me

TL;DR: When competitors order products or scrape services for corporate espionage, businesses must implement a multi-layered defense. Solutions range from immediate IP bans and automated behavioral analysis with tools like Fail2ban or WAFs, to ‘nuclear’ ASN/Geo-blocking for persistent adversaries.

When a competitor starts sniffing around your services, you can’t just ignore it. This guide covers how to identify and block unwanted traffic, from quick IP bans to robust, automated behavioral analysis.

I remember a gig back around 2016. We had just launched a slick new API for our SaaS product. We were a small, scrappy team, and we were proud of our documentation – it was clean, interactive, and way better than the incumbent’s. Two weeks later, our biggest competitor, a behemoth in the space, rolled out a “brand new” API doc portal. It was a pixel-for-pixel, word-for-word clone of ours. They’d just scraped the entire thing. We found their office IP addresses all over our Nginx logs, hitting every single page in sequence. It was infuriating, but it was also a lesson: if it’s on the public internet, assume your competition is watching.

That feeling—a mix of flattery and fury—is exactly what I saw in a recent Reddit thread. A small business owner noticed their main competitor making test orders, likely to reverse-engineer their product, fulfillment process, or pricing. It’s a classic move. So, let’s talk about what’s really happening and what you, as the engineer on the ground, can actually do about it.

First, let’s get one thing straight. The root cause here isn’t a technical flaw in your system. It’s the nature of public-facing services. Your website, your API, your storefront—they’re designed to be accessible. The challenge isn’t preventing access; it’s preventing unwanted access and abuse. They aren’t “hacking” you; they’re just using your front door like any other customer. Our job is to become a smarter bouncer.

The goal is to move from a simple “allow all” posture to one that intelligently identifies and mitigates traffic that looks less like a customer and more like a corporate spy with a web scraper.

We have a few tools in our belt, ranging from a quick fix to a more permanent, architectural solution. Let’s break them down.

This is the first thing everyone thinks of, and for good reason. It’s fast, simple, and provides immediate satisfaction. You’ve found their corporate I

Source: Dev.to