How Goody Goody Gum Drops Shut Out Card-Testing Bots and Out-of-Market Traffic with Blockify

A shopper named “John Doe” kept trying to buy a single $3 lolly. He came back several times a day, each time with a US address and a new @example.com email. He wasn’t a customer. He was a bot checking which stolen credit cards still worked, and Goody Goody Gum Drops was his testing ground.

Here’s how the family-run Australian lolly shop used Blockify to close its storefront to countries it doesn’t ship to, stop fake checkouts before they reach payment, and keep up as the attacks changed shape.

At a glance

Store	Goody Goody Gum Drops
Industry	Confectionery: wholesale lollies and promotional lolly bags
Platform	Shopify
Using Blockify since	July 2024
Threats	Out-of-market and data center traffic, card testing, fake checkouts
Blockify features used	Country Blocker (allowlist), Auto Block Fake Checkout, checkout rule by cart value

About Goody Goody Gum Drops

Goody Goody Gum Drops is a family business that has been selling lollies online since 2006. It’s a wholesale confectionery supplier on Shopify, selling bulk lollies and branded or unbranded promotional lolly bags to businesses and resellers, at prices home shoppers can get too. The store won APAC Insider’s award for Best Australian Online Confectionery Retailer in 2022 and again in 2026, and holds a 4.9/5 rating across 569 reviews.

The team moved to Blockify in July 2024 after their previous security app kept letting foreign traffic through. Their goal was simple: only real customers, in the markets they serve, should be able to reach the store and the checkout.

The Challenge: Bots and fraud at every door

1. Traffic from countries the store can’t serve

Goody Goody Gum Drops ships to seven countries: Australia, New Zealand, Hong Kong, Singapore, Canada, Ireland and the UK. Anyone browsing from outside those markets can’t place a real order, so every visit from elsewhere was, at best, a shopper who would leave disappointed, and at worst, a bot.

The visitor data made it clear. A steady stream of traffic came from a Hetzner data center in Germany, a country the team had never run a single campaign in. Data centers host servers, not shoppers. Traffic like this inflates analytics, opens the door to scraping and fraud, and tells you nothing about real demand.

2. Card testing on the cheapest product

Bots placed the store’s cheapest item, a $3 product, several times a day. The details shifted from one wave to the next. In March, the team noticed every order used a different email address and suspected the sender was in France. By July, orders arrived under John Doe and other made-up names, with fake addresses like @example.com. Across the waves, the same warning signs kept showing up:

• Name: placeholder names such as John Doe
• Email: a new @example.com address on every attempt
• Address: somewhere in the US
• Cart: one $3 item

This is card testing. Fraudsters run small purchases to find out which stolen cards still work, then use those cards for larger purchases somewhere else. Picking the cheapest product keeps each test small enough to avoid attention.

Most attempts failed, but one order went through and was paid. The team had to cancel it and refund the card. Each successful test risks a chargeback, extra payment processing fees and flags from the payment provider, on top of the time spent checking orders by hand. The checkouts that didn’t complete piled up as abandoned carts, cluttering the data the team uses to recover real lost sales.

The attacks kept coming back

This wasn’t a one-off. The team saw waves of suspicious activity in December 2025, March 2026, July 2026 and October 2026. Each wave looked a little different. Blocking one route only pushed the bots to try another.

One audit, three rules, every shortcut to checkout closed

Phase 1: See who is actually visiting

Blockify’s visitor analytics showed where traffic was coming from, including visits from countries outside the store’s shipping zones and from data center IPs like the Hetzner server in Germany. That made the first fix obvious.

Phase 2: Allow only the seven shipping countries

Instead of listing every country to block, the team set up a single allowlist rule: allow Australia, New Zealand, Hong Kong, Singapore, Canada, Ireland and the UK, and block everything else.

An allowlist is easier to maintain than a blocklist. One rule covers every other country in the world, and the team doesn’t have to update it each time traffic shows up from somewhere new. If Goody Goody Gum Drops starts shipping to a new market, they add one country to the list.

Phase 3: Stop bots that skip the storefront

Card-testing bots rarely browse. They go straight to checkout with a cart link such as /cart/12345678:1, a product variant ID and a quantity, so they never load a single product page.

Blockify’s Auto Block Fake Checkout closes that shortcut. It creates a hidden product called “Invalid Variant from Blockify” and keeps it in draft, so customers never see it. When a cart goes straight to checkout without passing through the storefront, Blockify adds this product to the cart and sends the visitor back to the storefront. The bot can’t complete payment, and real shoppers, who come through the store as normal, never notice it.

Phase 4: Block checkout for $3-and-under carts

The last layer targeted the bots’ favourite move. The team created a checkout rule that blocks checkout when the cart total is $3 or less, the price of the store’s cheapest product.

Real Goody Goody Gum Drops customers are wholesale buyers and businesses ordering lollies by the bag, box and bulk order. Almost nobody checks out with a single $3 item. The bots always did. So this rule removes the one cart a card tester needs, while real wholesale orders go through as usual.

Why three small rules beat one big wall

Each rule catches a different part of the attack:

Layer	What it checks	What it stops
Country allowlist	Where the visitor is	Out-of-market and foreign data center traffic
Auto Block Fake Checkout	How the visitor reached checkout	Bots using direct cart links
Cart value rule	What is in the cart	Low-value test orders that slip past the first two

If a bot changes its location, it still has to get past the checkout path and cart rules. If it changes its route, the location and cart rules still apply. And none of it requires Shopify Plus.

What the store looks like to a bot now

The team didn’t track before-and-after numbers for these incidents, so this story is about what changed in how the store is protected, not a percentage.

• The storefront only serves the seven markets the store ships to. Visits from other countries and foreign data centers are blocked before they reach a product page.
• Direct-to-checkout bots get sent back to the storefront. Cart links that skip the store can’t reach payment.
• $3 test orders are stopped at checkout. The cheapest product is no longer an easy target for card testers.
• Less manual cleanup. Fewer fake orders to cancel and refund, and fewer fake abandoned carts mixed in with real ones.
• Protection that adapts. When new waves arrived in 2026, the team could respond with an extra rule instead of switching tools.

Fraud doesn’t visit once. It comes back in waves

The Goody Goody Gum Drops story shows how fraud works on a small wholesale store. It doesn’t arrive once and leave. It comes back in waves, and each wave tests a new gap: a different country, a direct checkout link, a fresh batch of fake emails.

A single setting won’t hold for long. What works is a few simple rules that each check something different, and a tool that lets you add the next rule in minutes when the pattern changes.

Card testers look for stores that let them reach checkout cheaply and easily. Blockify lets you close each route with a few simple rules, on any Shopify plan.