Researchers from Akamai have discovered a new scalping technique used against MyVisit in Israel that involves scalpers using bots to book appointments for government services then selling those services to paying citizens. MyVisit is an appointment booking service used by many government entities in Israel. The entire situation started with an open-source bot named “GamkenBot” that was created to help Israeli citizens book passport appointments with the Ministry of the Interior. At the time, the ministry had a backlog of over 700,000 applications with new appointments being booked almost immediately. While the bot had made it easier for normal users to book appointments, scalpers quickly exploited it. Less than one (1) week after GamkenBot gained attention, a Telegram channel by the name of “MyVisit Appointments Group” was created. The administrators of the group claimed to have developed a bot to scan and book appointments to various websites. They began selling appointments for not only the Ministry of Interior but also the Population Authority, Israel’s Electricity Corporation, the National Insurance, Israel Post, the Ministry of Transportation, and other government services. Appointment slots could be bought for 400 Shekels (around $120 at the time of publishing) with discounts for multiple appointments. While the administrators of this group are currently using the bot for financial gain, Akamai researchers warn that the bot could also be used in a denial-of-service attack. MyVisit attempted to block these bots by utilizing a CAPTCHA service on its booking page, though the developers were able to bypass it days after implementation. The Akamai researchers detailed other mitigation attempts that MyVisit could incorporate, though they note that any anti-bot measure can be bypassed by “a threat actor with enough motivation and resources.”