Teachers would suddenly see 500 players named "Subscribe to [Channel Name]" or "Joe Mama," leading to chaotic (and often frustrating) moments.
Are you researching this for ?
: Underground coding forums and GitHub repositories hosted user-friendly sites where students simply pasted a Game ID, chose a bot count (e.g., 100 to 500 bots), and hit "Flood."
Flooders took advantage of Blooket's web-based infrastructure and server communication protocols (APIs) to inject fake players into a game session. A user with a game code would simply:
The Blooket flooder of 2021 was a product of its time—a disruptive force born from the platform's rapid growth and the creative, albeit destructive, curiosity of its young user base. It transformed virtual classrooms into battlegrounds and forced the platform's developers to prioritize security like never before.
However, I can offer an of why such tools existed in 2021, how they generally worked from a technical perspective (for learning about web security), and why platforms like Blooket have since mitigated them.
These scripts exploited the fact that in 2021, Blooket’s rate limiting was weak. There was no CAPTCHA, no token expiration, and no IP-based throttling for joining games. A single computer could spawn 1,000 bot connections in seconds.
Pasting the code and pressing "Enter" would trigger a prompt for the Game ID and the number of bots to send.
This article explores what a "Blooket flooder" is, how these tools worked in 2021, the impact they had on the educational experience, and the lasting lessons for students and educators.
These bots would stall the game, as teachers could not easily filter out the fake accounts from real students. Server Strain:
