Use case

Proxies for Whatnot: Live Auctions Behind Kasada

Proxies for Whatnot: the live-shopping marketplace runs the heaviest defense stack we tested, Kasada plus Cloudflare, F5 Shape and DataDome, and it blocked our datacenter IP outright. Which proxy type fits auction and seller data, and why live commerce is different.

HProxy Team··6 min read
HProxy.Use case

Free proxies won't hold up here.

Shared datacenter IPs get flagged and dropped fast. When it has to hold, gaming, streaming, accounts, you need mobile and residential IPs that read as a real device, from $0.44/GB, pay as you go.

See plans & pricing

Proxies for Whatnot face the heaviest defense stack in this entire test. On 24 August 2026 we sent whatnot.com a plain request from a home connection and it loaded, HTTP 200, but the page carried four bot vendors: Kasada (eleven markers), Cloudflare, F5 Shape and DataDome. The identical request from a datacenter server got Cloudflare's "Just a moment" challenge and never reached the store. Four layers, and the datacenter IP was gone at the door. This is the hardest target in the batch, and it is also a different kind of target.

Whatnot is the largest live-shopping marketplace, where sellers run real-time video auctions across more than 140 categories in nine countries, from trading cards and Funko to sneakers and vintage fashion (Vendoo, how Whatnot works). Its data is not a catalog of prices; it is a stream of live auctions, bids and seller performance, which changes both what you collect and how proxies fit.

What proxies work best for Whatnot?

US rotating residential proxies behind a real browser, one exit per session, because the stack scores reputation, fingerprint, proof-of-work and behavior together. Datacenter proxies do not survive it.

Four defenses, and the hardest is Kasada

The stack is the story. Cloudflare scores IP reputation and served our datacenter IP the Just a Moment challenge (how to scrape past Cloudflare). Behind it, Kasada issues a JavaScript proof-of-work: the client has to run Kasada's obfuscated script and return a computed token before it is trusted, which a bare HTTP client cannot do (how to get past Kasada). F5 Shape scores session behavior over time (how to handle F5 Shape), and DataDome adds another request-level challenge (how to get around DataDome). No single trick clears all four; only a real browser on a trusted residential IP, behaving like a person and holding one exit, gets through. This is Chewy's triple stack with a fourth vendor and a marketplace behind it.

Whatnot's four-layer door
  1. Cloudflare
  2. Kasada
  3. F5 Shape
  4. DataDome

The heaviest stack in the test; a bare client fails the first gate, a solver only one of four

Source: HProxy: whatnot.com carried Kasada, Cloudflare, F5 Shape and DataDome on 24 August 2026; datacenter IP got Just a Moment

Live commerce is a different data problem

Whatnot is not a price list to snapshot; it is live commerce. The value is in real-time auction streams, the bids, the final sell-through, and seller performance across categories, which is time-series, event-driven data rather than a static catalog. Monitoring it means holding a session during a live show and following the auction, which makes stable, sticky residential exits and a genuine browser more important than fast rotation. It is closer to watching a drop unfold than reading a shelf, so the discipline overlaps the queue-and-drop world of Pokemon Center and the resale market of GOAT.

The legitimate job is data: prices realized, sell-through rates, which categories and sellers move. A proxy keeps sessions and any accounts isolated and trusted so that monitoring runs without one address looking like a bot. It does not place bids, beat auction timing, or defeat per-account limits, and bid automation or multi-accounting runs against Whatnot's terms.

Which proxy type fits which job

Whatnot jobProxy typeWhy
Live auction and price monitoringUS rotating residential, sticky per sessionSessions span live shows; the stack rewards consistency
Sell-through and category analyticsRotating residential behind a browserVolume across a pool, the four-layer stack needs a browser
Seller performance trackingSticky residential per sessionFollowing a seller's live shows over time
Account isolation for multiple watchersStatic ISP, one per accountKeeps accounts unlinked
Parser and liveness testsResidential (datacenter is blocked)Datacenter fails at the Cloudflare gate

Rotating residential IPs pass the reputation gate and let a browser hold a live-show session, and ISP proxies keep an account on one stable, isolated address. The two are compared in rotating vs static residential proxies.

Setup

Drive a real browser, because Kasada's proof-of-work and Shape's behavioral score both require genuine execution, and hold one residential exit per session so the session stays coherent through a live show (proxies for Playwright). Collect the auction events, bids and sell-through as time-series data rather than snapshotting a page. For account isolation, one static ISP address per account. Pace like a viewer, not a crawler.

Sizing

Whatnot sizes by concurrent sessions, because each live show is a session held over time, not a quick read. Decide how many shows or sellers you follow at once, and run one sticky residential exit per session, each behind a browser. Budget browser-level bandwidth, which is high for live video pages (headless browser proxy bandwidth cost). Our pricing is pay-as-you-go with a balance that does not expire.

Free versus paid for Whatnot

A free proxy is a datacenter address the Cloudflare-plus-Kasada stack blocks on contact, and it cannot run the proof-of-work or hold a live session. Free proxies confirm a public page loads from a clean residential IP, which our free proxy list and proxy checker cover. Monitoring Whatnot needs residential from $0.44/GB pay-as-you-go with no KYC behind a real browser. The line is in datacenter vs residential proxies.

Staying unblocked

  • Do not rotate mid-session. Against Kasada and Shape, an IP swap inside a live-show session breaks the token and the score.
  • Run a genuine browser. Kasada's proof-of-work and Shape's behavior score both need real execution.
  • Hold sticky exits for live shows. Auctions are time-series; a stable session is the point.
  • Isolate accounts. One static address per account if you run more than one.
  • Watch the challenge rate. A rising share of challenges means slow down or widen the pool. The full list is in avoiding IP bans while scraping.

What a proxy does not do here

A proxy gives a browser a trusted residential address and keeps sessions and accounts apart. It does not run Kasada's proof-of-work, does not make a headless client behave for Shape, does not place or snipe bids, and does not defeat per-account limits. Scraping whatnot.com, automating bids and multi-accounting all run against Whatnot's terms, a risk that stays with you regardless of the IPs. What a residential exit does is get a genuine browser past a four-layer door that stops a datacenter client cold, so legitimate auction and seller monitoring can run. Test with the free proxy list, then monitor live auctions with residential from $0.44/GB.

Sources

  • Vendoo, how Whatnot works, a guide for sellers and buyers: the live-auction model, 140-plus categories and nine countries.
  • Kasada, bot defense platform: the proof-of-work layer, the heaviest of the four.
  • Cloudflare, bot management: the reputation layer that blocked our datacenter IP.
  • HProxy test on 24 August 2026: plain GET requests to whatnot.com from a residential IP (HTTP 200, page carried Kasada, Cloudflare, F5 Shape and DataDome markers) and a datacenter IP (Cloudflare Just a Moment challenge).

Frequently asked questions

What proxies work best for Whatnot?
US rotating residential proxies behind a real browser, held on one exit per session, because Whatnot runs the heaviest stack in our test: Kasada plus Cloudflare, F5 Shape and DataDome. A home IP loaded the site while our datacenter server got Cloudflare's Just a Moment, and Kasada's proof-of-work sits behind that. Datacenter proxies do not survive this stack; residential behind a genuine browser is the floor.
Why is Whatnot so hard to scrape?
Because it stacks four defenses. Our test found Kasada (a JavaScript proof-of-work), Cloudflare, F5 Shape and DataDome on the same property, and the datacenter IP was blocked outright. Kasada in particular requires running an obfuscated script and returning a computed token, which a bare HTTP client cannot do. Only a real browser on a trusted residential IP clears the combination.
How is scraping a live-auction marketplace different?
Whatnot is live commerce, not a price list. Value lives in real-time auction streams, bids, sell-through and seller performance across more than 140 categories, so the data is time-series and event-driven rather than a static catalog. Monitoring it means holding sessions during live shows, which makes stable, sticky residential exits and a real browser more important than raw rotation.
Can a proxy help me win or snipe a Whatnot auction?
A proxy keeps accounts and sessions isolated and trusted, which matters if you run more than one, but it does not place bids for you, beat the auction timing, or defeat per-account limits. Bid automation and multi-accounting run against Whatnot's terms. The legitimate use is data: watching prices, sell-through and seller activity, not manipulating live auctions.
Do free proxies work for Whatnot?
No. Free proxies are datacenter addresses, and the Kasada-plus-Cloudflare stack blocked our datacenter IP on contact. They cannot run Kasada's proof-of-work or hold a live-show session. Free proxies confirm a public page loads from a clean residential IP; monitoring Whatnot needs residential behind a real browser.

Proxies that don't die mid-job

Residential, ISP, datacenter and mobile, verified by the same engine that runs tens of millions of checks. They read as a real device and hold up under load. Pay as you go, and your balance never expires. $0.44/GB is the 2,000 GB+ rate; a single gigabyte is $0.50/GB, with no minimum order.

129M+ proxy checks run · 100+ countries · HTTP / HTTPS / SOCKS · re-checked every few minutes · no signup