Probably the most powerful bypass I ever found in botting, and it happened mostly because I'm Belgian. January 2022. Footlocker was basically a cache bypass game at that point. They cached the OOS cart response per IP for a couple minutes, so the second you triggered it every request after that was useless until it cleared. I was looking for a new cache bypass and ran a subdomain sweep, and that's when I hit staging.footlocker.be. If I wasn't from Belgium I doubt I'd have ever thought to check for it. The plan was just to test it for cache bypasses. We ended up finding way more than that. Unlike basically every other staging/dev endpoint out there, this one was actually hooked into their production hybris instance (the ecommerce platform Footlocker used back then). Took a bit of digging to realise there were 4 active staging domains, BE, NO, HU and CZ. And through an old url alias (api/carts pointed to api/flfr/carts) we could reach every other region from them too, FR, UK and the rest. That let us bypass every antibot they had running at the time. Datadome, the infamous perma queue, rate limits, everything. Then one extra header pushed it over the edge. Their setup ran behind Fastly so we just sent the fastly-client-ip header ourselves, and suddenly we were running fully proxyless. We knew we were sitting on gold so we had to be careful with it. We had a server side toggle that controlled the % of requests going through this route, which was basically a kill switch. Set it too high and you'd instantly fry their servers and make the drop take forever, so we built a tool that kept measuring response times and adjusted the % on the fly. Best decision we made, because it ended up taking 8 months before it got fully patched.