We watch the visa appointment portals 24/7, so a cancellation that lives nine seconds does not slip past.
Appointment slots at VFS Global open at random hours and are gone in 3–15 seconds at peak season. This watches them 24/7 and puts an alert on the operator's phone — naming the clients who are waiting for that exact date.
The bot watches. A human books.A small agency does ~25 bookings a month, all by hand. Clients are asking for Italy Schengen. The slots exist — they just don't wait.
Next month's calendar opens on the 1st–5th, in early embassy hours. Many slots at once, gone in minutes.
One slot, no warning, alive for 3–30 seconds. This is where most bookings actually come from — and where manual watching fails completely.
One operator can watch one tab. Twenty-five clients across multiple countries and cities is not a refresh problem, it's an arithmetic one.
Everything in the design follows from this, and it is permanent — not a feature waiting to be built.
The bot watches.
A human books.
There is no auto-booking.
Not a phase · not a stretch goal · no column in the schema
Auto-booking is not risky for us. It is risky for the client — and the client has already paid. A Schengen applicant is ~₹8,600 in before a slot is visible; a US applicant is ~₹16,000 in MRV fees. The US Embassy in India has cancelled 2,000+ bot-booked appointments, suspended the accounts' scheduling privileges, and named agents and fixers as the target of a zero-tolerance policy. That downside lands on the customer, not the agency.
| Watching — what this does | Auto-booking — what it never does | |
|---|---|---|
| Account used | One dummy watcher account | The client's own account |
| Actions taken | Read-only calendar polls | Writes: hold, submit, pay |
| Worst case | Dummy account flagged — make another | Appointment cancelled, fees gone, scheduling suspended |
| Who absorbs it | Us | The client who paid us |
This is why it is sellable to other agencies. An agency buying a booking bot is buying a liability it cannot insure. An agency buying an alerting bot is buying reaction time, and keeps the human judgement — and the accountability — where it already sits. Client credentials are never stored. The database has no column for them and will not grow one.
Five parts. A watch target goes in from Telegram; an alert with names on it comes back out.
The client join is what makes it usable at 25 bookings a month. The operator doesn't decide whether the slot matters — the alert already says who it's for.
Captchas only fire at login, and login is rare by design — one to three a day. The screenshot goes to the operator on Telegram, who types the answer back. No solver subscription.
This is the whole thesis. Embassies outsource appointments to a handful of companies, so the unit of work is the company — not the flag. Build Italy, and Europe is nearly built.
watch_targets, not a new module. A minority of VFS countries run older custom portals and need a per-country override hook — budget half a day each, not a rewrite. * Spain routes to VFS in some jurisdictions and BLS in others; confirm per city.Two design decisions do most of the work: poll faster only when it matters, and never put the fast path behind a browser.
Phase 1 is deliberately the hardest scraper on the list. VFS runs Cloudflare, DataDome and a login-walled calendar; getting through it forces the session, proxy and anti-detection layers to be real. Everything after inherits them and gets cheaper.
This is a slot-scarcity engine. Visa appointments are just the first scarce-slot market.
Strip the domain away and what is left is a machine that watches a source which releases inventory in unannounced batches, detects the change in seconds, and puts it in front of the one human who can act on it — with the context of who is waiting already attached. Visa slots are a good first market because the scarcity is severe, the stakes per slot are high, and the incumbent method is a person refreshing a browser. They are not the only market shaped that way.
The moat is not the scraper. Scrapers get rewritten. The moat is that this is the version an agency can actually put its name on: it never touches a client account, never stores a credential, and never puts a customer's ₹16,000 at risk to save the operator thirty seconds.