Marta has been following the same routine for three weeks. At 7:55 a.m., she opens her laptop in the kitchen, before taking her children to school, and waits until 8:00 a.m., the time the public agency opens new slots for in-person service. She needs an appointment to process some documents that expire at the end of the month. She fills out the form with her postal code, the reason for her request, and her national identity card number. The system responds: no appointments available.
Her brother tries at 8:01 from his cell phone. A colleague, at 8:03. A neighbor, at 12:00. None of them find a single opening. Even so, appointments are being granted: an acquaintance of Marta’s got hers by paying an intermediary who, she says, “has them all.”
This is the story of how a public body with this problem worked with Transparent Edge engineers so that people like Marta could find legitimate dates fairly.
The challenge
Appointments are a limited and highly sought-after resource. They are released in specific time slots, and these slots are the target of those who automate processes to acquire and then resell them. A person takes minutes to complete the form. A script completes it in milliseconds.
The operators who monopolize appointments act methodically. They analyze the form’s flow, look for the weakest point, and navigate it using automated systems: program-controlled browsers, automation extensions, and, increasingly, AI-powered engines. These slots are reserved and resold as a service.
The usual defenses fell short for four reasons:
➜ CAPTCHAs are solved at scale. There are solver farms, human or based on AI models, that surpass it in volume.
➜ Blocking by IP address or country doesn’t work. The traffic arrives via residential and mobile proxies from local operators, from the same networks used by everyone. Its geolocation sometimes contradicts the declared origin.
➜ Classic rate limiting is circumvented. The volume is distributed among thousands of unique IPs with very few requests each, and none reach a threshold per IP.
➜ The request data is falsified. Headers, cookies, parameters, JavaScript execution and client footprint can be simulated.
The malicious traffic resembled legitimate traffic in almost every way that a traditional defense measures. Detection had to combine several signals.
Deployment of the protection strategy
The Transparent Edge team began by understanding what the client wanted to protect in order to determine the best configuration for Perimetrical. The primary goal was to restore access to citizens who wanted to legitimately consult and book appointments. The engineers placed the service behind the CDN so that filtering would be applied before reaching the source, analyzed the actual traffic, and designed a layered scheme that separated valid traffic from invalid traffic. Each layer discarded a portion of the invalid traffic and allowed the rest to pass to the next layer.
The strategy covers six layers:
- Reputation and origin. Evaluation of the IP address, its geolocation, and its consistency with the rest of the signals in the request.
- Customer identity. Verification of cookies and user-agent, and analysis of the customer’s digital fingerprint.
- Execution in the browser. Verification that the client executes JavaScript as a real browser would.
- Behavior. Analysis of how the customer interacts with the page, compared to the patterns of a human user.
- Navigation sequence. Validation that the journey through the service has the expected order and transitions.
- Request integrity and volume. WAF protection against manipulated requests, and volume control with automatic peak hardening.
The engineers parameterized each layer with the client and adjusted it with real traffic, checking for false positives to minimize friction.
Transparent Edge’s solution in action
When a batch of appointments is published, traffic to the form multiplies in seconds. This is the moment the system was designed to handle.
Each request passes through the layers in order. Suspicious signals add risk points, and dubious traffic receives a JavaScript challenge. A legitimate browser resolves it without the user noticing. An automated client that fails is rejected.
Transparent Edge’s Bot Management provides the client and behavioral layer. This layer detects operators attempting to impersonate a real user and discards anything that doesn’t match human behavior. The WAF protects request integrity, ensuring that a compromised request cannot be reused. When the volume exceeds a defined limit, Under Attack Mode intensifies verification for the duration of the spike.
The engineers monitored the configuration after it went into production. With each new automation variant that emerged, they expanded or adjusted the rules.
Our actions produce results
People like Marta are finding available dates again when they’re posted. Automated traffic that previously filled all the slots is now challenged or blocked before reaching the form.
The outcome depends on the quality of the filtering. A lax configuration lets bots through, while a strict one blocks citizens. That’s why the configuration is built by engineers who understand the behavior of current bots and who monitor the service after deployment, because automation operators change their methods when they are blocked.
If you recognize this pattern in your service, tell us about your situation. Our engineers will review the flow and traffic with you and propose a customized configuration tailored to your protection needs.
Sonia Arévalo is Product Marketing Manager at Transparent Edge.
How a Systems Analyst ended up studying Food Technology is hard to explain. Add the fact that she later decided to go into Digital Marketing, and it’s a complete mystery how this girl manages to do so many things so well. More Argentinian than asado, Sonia keeps our website and social media running, translating complex
elvishtech-speak into something normal humans can actually understand. “Excelente”—with that unmistakable Argentine flair—is her favorite go-to word, and it perfectly matches the quality of her work.
