Proxies for Whatnot face the heaviest defense stack in this entire test. On 24 August 2026 we sent whatnot.com a plain request from a home connection and it loaded, HTTP 200, but the page carried four bot vendors: Kasada (eleven markers), Cloudflare, F5 Shape and DataDome. The identical request from a datacenter server got Cloudflare's "Just a moment" challenge and never reached the store. Four layers, and the datacenter IP was gone at the door. This is the hardest target in the batch, and it is also a different kind of target.
Whatnot is the largest live-shopping marketplace, where sellers run real-time video auctions across more than 140 categories in nine countries, from trading cards and Funko to sneakers and vintage fashion (Vendoo, how Whatnot works). Its data is not a catalog of prices; it is a stream of live auctions, bids and seller performance, which changes both what you collect and how proxies fit.
What proxies work best for Whatnot?
US rotating residential proxies behind a real browser, one exit per session, because the stack scores reputation, fingerprint, proof-of-work and behavior together. Datacenter proxies do not survive it.
Four defenses, and the hardest is Kasada
The stack is the story. Cloudflare scores IP reputation and served our datacenter IP the Just a Moment challenge (how to scrape past Cloudflare). Behind it, Kasada issues a JavaScript proof-of-work: the client has to run Kasada's obfuscated script and return a computed token before it is trusted, which a bare HTTP client cannot do (how to get past Kasada). F5 Shape scores session behavior over time (how to handle F5 Shape), and DataDome adds another request-level challenge (how to get around DataDome). No single trick clears all four; only a real browser on a trusted residential IP, behaving like a person and holding one exit, gets through. This is Chewy's triple stack with a fourth vendor and a marketplace behind it.
- Cloudflare
- Kasada
- F5 Shape
- DataDome
The heaviest stack in the test; a bare client fails the first gate, a solver only one of four
Live commerce is a different data problem
Whatnot is not a price list to snapshot; it is live commerce. The value is in real-time auction streams, the bids, the final sell-through, and seller performance across categories, which is time-series, event-driven data rather than a static catalog. Monitoring it means holding a session during a live show and following the auction, which makes stable, sticky residential exits and a genuine browser more important than fast rotation. It is closer to watching a drop unfold than reading a shelf, so the discipline overlaps the queue-and-drop world of Pokemon Center and the resale market of GOAT.
The legitimate job is data: prices realized, sell-through rates, which categories and sellers move. A proxy keeps sessions and any accounts isolated and trusted so that monitoring runs without one address looking like a bot. It does not place bids, beat auction timing, or defeat per-account limits, and bid automation or multi-accounting runs against Whatnot's terms.
Which proxy type fits which job
| Whatnot job | Proxy type | Why |
|---|---|---|
| Live auction and price monitoring | US rotating residential, sticky per session | Sessions span live shows; the stack rewards consistency |
| Sell-through and category analytics | Rotating residential behind a browser | Volume across a pool, the four-layer stack needs a browser |
| Seller performance tracking | Sticky residential per session | Following a seller's live shows over time |
| Account isolation for multiple watchers | Static ISP, one per account | Keeps accounts unlinked |
| Parser and liveness tests | Residential (datacenter is blocked) | Datacenter fails at the Cloudflare gate |
Rotating residential IPs pass the reputation gate and let a browser hold a live-show session, and ISP proxies keep an account on one stable, isolated address. The two are compared in rotating vs static residential proxies.
Setup
Drive a real browser, because Kasada's proof-of-work and Shape's behavioral score both require genuine execution, and hold one residential exit per session so the session stays coherent through a live show (proxies for Playwright). Collect the auction events, bids and sell-through as time-series data rather than snapshotting a page. For account isolation, one static ISP address per account. Pace like a viewer, not a crawler.
Sizing
Whatnot sizes by concurrent sessions, because each live show is a session held over time, not a quick read. Decide how many shows or sellers you follow at once, and run one sticky residential exit per session, each behind a browser. Budget browser-level bandwidth, which is high for live video pages (headless browser proxy bandwidth cost). Our pricing is pay-as-you-go with a balance that does not expire.
Free versus paid for Whatnot
A free proxy is a datacenter address the Cloudflare-plus-Kasada stack blocks on contact, and it cannot run the proof-of-work or hold a live session. Free proxies confirm a public page loads from a clean residential IP, which our free proxy list and proxy checker cover. Monitoring Whatnot needs residential from $0.44/GB pay-as-you-go with no KYC behind a real browser. The line is in datacenter vs residential proxies.
Staying unblocked
- Do not rotate mid-session. Against Kasada and Shape, an IP swap inside a live-show session breaks the token and the score.
- Run a genuine browser. Kasada's proof-of-work and Shape's behavior score both need real execution.
- Hold sticky exits for live shows. Auctions are time-series; a stable session is the point.
- Isolate accounts. One static address per account if you run more than one.
- Watch the challenge rate. A rising share of challenges means slow down or widen the pool. The full list is in avoiding IP bans while scraping.
What a proxy does not do here
A proxy gives a browser a trusted residential address and keeps sessions and accounts apart. It does not run Kasada's proof-of-work, does not make a headless client behave for Shape, does not place or snipe bids, and does not defeat per-account limits. Scraping whatnot.com, automating bids and multi-accounting all run against Whatnot's terms, a risk that stays with you regardless of the IPs. What a residential exit does is get a genuine browser past a four-layer door that stops a datacenter client cold, so legitimate auction and seller monitoring can run. Test with the free proxy list, then monitor live auctions with residential from $0.44/GB.
Sources
- Vendoo, how Whatnot works, a guide for sellers and buyers: the live-auction model, 140-plus categories and nine countries.
- Kasada, bot defense platform: the proof-of-work layer, the heaviest of the four.
- Cloudflare, bot management: the reputation layer that blocked our datacenter IP.
- HProxy test on 24 August 2026: plain GET requests to whatnot.com from a residential IP (HTTP 200, page carried Kasada, Cloudflare, F5 Shape and DataDome markers) and a datacenter IP (Cloudflare Just a Moment challenge).