Vinted Listing Monitoring with a Telegram Bot and Anti-Blocking Protection

The challenge

Manually update the search on Vinted several times a day, so as not to miss the desired lot — lesson boring and unreliable: interesting ads disassemble in minutes. It needed a bot that checks several saved requests, sends a card immediately when a new product appears, and does not require switching between the site and Telegram.

A separate condition of — is not to turn monitoring into aggressive scraping. Vinted restricts frequent requests, and the service should behave predictably: observe pauses, recover from time restrictions and do not block accounts that the owner actually uses.

How the service is not blocked

1. A pause at identity, not a request

   All links of one Vinted account — including different domains like vinted.pl and vinted.de — share one timer: the account has one IP and one session for all, so the pause is common. Only guest requests without an account are grouped separately, by domain.

   45–75 with default · redefined individually to account

2. Exponential cooldown after errors

   After 401, 403 or 429, the pause for this identity increases exponentially rather than being reset to default. The first successful answer nullifies the counter.

   401 / 403 / 429 · exponential backoff

3. Freeze and report to any non-200

   Any response other than 200 freezes identity entirely for at least 10 minutes and adds the string to a separate markdown report: time, link, account, domain, status, action taken. Neither cookies nor proxy passwords are included in the report.

   report_not_200.md · Facts, No Secrets

4. Backup proxy only after repeated restrictions

   Direct connection remains the main route. A common backup proxy is turned on for an account only after repeated — restrictions, this is a temporary measure, not a permanent mode of operation.

   failover, not default route

5. Personal proxy with fail-closed behavior

   For a separate account, you can set a permanent SOCKS5 proxy. If this proxy has any error — wrong password, inaccessible port, the timeout — request ends with an error without rolling back on the direct connection. The account cannot be physically lit up from the IP server.

   socks5h · DNS via · fail-closed proxy

6. Automatic update of the session

   The bot checks valid authorization, updates tokens on the official refresh-flow before expiration or at 401 and atomically stores the updated cookie — without manual re-entry to the site.

   JWT refresh · atomic cookie save

Accuracy: No duplicates and no false notifications

• One lot of — one notification. The same ad is seen on several Vinted domains under the common numerical id; the send request is reserved in a separate table for this id, so that the second link that finds the same lot silently marks it delivered.
• The new — is not the same as the unknown. After adding the link, the bot saves the current output without sending and remembers the maximum id as the boundary. An old ad returned to an unstable issue with a smaller id is not notified again by —.
• The problem link does not block the others. If a particular link receives 403 several times in a row, only — will be suspended for 10 minutes, regardless of the total cooldown account.

What the user gets from Telegram

Operation

The service works as a systemd unit with autorestart when crashed. Backup is started by a timer once a day: a consistent snapshot of SQLite is taken directly while the bot is running (through the regular backup API base, without stopping the process), is packaged together with the configuration and cookie sessions and goes by SSH to the trusted — store the last seven versions are always at hand.

Before each release runs a set of 100 autotests and check the syntax of all modules — corrections logic prices, deduplication and limiter requests do not go into production without verification.

Security

• Passwords, tokens, cookies and authorization headers never enter the — logs either in normal mode or in case of errors.
• In the report on non-200 responses and in the proxy log, only technical fields are written: account, domain, status, duration of the — request without credentials
• cookie session files and secrets are stored with 600/700 rights, available only to the bot process
• Personal proxy account operating in fail-closed — mode proxy error does not lead to hidden switching to direct connection
• Backups are not encrypted on disk, but are transmitted only over SSH and stored on a trusted NAS, not in the site directory.

The result

The owner receives instant notification of a new ad on several saved Vinted requests, fully manages links and accounts from Telegram and does not think about blocking: the service itself withstands pauses, rolls back to the backup route if necessary and restores the session without manual intervention.

Duplicated ads from different domains do not create unnecessary notifications, and old lots that returned to unstable issuance are not confused with the really new —.