How do RW Item Market Mugbots work?
The mugger manually browses the item market, manually clicking on any items not currently being tracked by their mugbot (a Greasemonkey script can be used to highlight those items). Clicking on the item market item will show you the seller's name.

A Greasemonkey script extracts the damage/accuracy (or armor) numbers, the item type, the price, the bonuses, and the seller ID and sends those to your mugbot.
The mugbot then polls the Torn itemMarket API endpoint every X seconds and checks to see if there's an item matching the damage/accuracy (or armor), item type, price, and bonuses still for sale in the item market.

If the item is no longer available in the market, the mugbot issues an API call to see if the sellerID has been active since the last time we saw this item in the item market - if not, it sends a discord ping to mug the person.

And that... is the fundamental loop.
Which items do mugbots target?
You have to be able to connect an item you manually see in the item market with the same item in the API call - so you need identifying characteristics (the seller information is not present in the API call).
This works best for RW weapons. The accuracy/damage, bonus name, item type, and price are practically always unique.
This works pretty well for RW armor - but it's not always unique, since there's only a single armor rating (instead of an accuracy and a damage rating), and within a set they all share the same bonus name, and pricing is highly competitive (so often pricing matches).
Riot and Assault armor sells pretty well though, and provide numerous mugging opportunities every single day. These opportunities are highly competitive, and require checking back frequently throughout the day to get the seller IDs on all the new listings (or re-priced old listings).
RW weapons sell slower. Filtering out top 100 stat players and only monitoring the 29 best RW weapons, I see ~15 sales resulting in reasonable mug opportunities a day - and I only manually check the item market once each morning (likely more opportunities are available if you check back throughout the day).
Top Selling RW Stats
Since a mug opportunity is only triggered when an item disappears from the item market while the seller is offline... I've accidentally stumbled into an interesting dataset of what RW weapons are actively selling in the item market.
Of the RW Armor, I already mentioned that riot sells like hotcakes, and assault is not too far behind.
Of the 29 RW weapons I was tracking, here's the top sellers*:
Top-Sellers by Item Name
1) ArmaLite M-15A4
2) Qsz-92
3) Metal Nunchaku
4) Enfield SA-80
5) Tavor TAR-21
6) Yasukuni Sword
7) BT MP9
8) SIG 552
9) Kodachi
10) Macana
Top-Sellers by Bonus
1) Warlord
2) Specialist
3) Assassinate
4) Disarm
5) Powerful
6) Deadeye
7) Motivation
8) Wind-up (wtf?)
9) Rage
10) Expose
11) Bloodlust
12) Wither
13) Conserve
14) Focus
15) Weaken
Top-Sellers by Player Name
LegendaryKing11 had the most sales while he was offline by a large margin - no wonder the poor guy was burnt out watching his timers all the time. _SCOFIELD_ was a respectable second, coming in about half of LegendaryKing11. Everyone else came in far lower.
* Note that these are the top-sellers from people who were not online at the time the item disappeared from the item market, which let us confirm the sale. Power sellers who are online all the time won't have their data represented in this (since we couldn't detect the sale). Also Anonymous sales aren't reflected.
Competitiveness and API Key Usage
Mugbot competitiveness is all about getting the most out of your API keys. You are allotted only 100 Torn API calls per minute, per API key. So with your single API key, that would mean you could only watch ~100 items at a time with the fundamental loop described earlier.
So the first improvement to that loop we make is to submit one API call per itemType, rather than per item. This gives us a list of all items matching a particular itemType with ANY bonus on them, with usually 1-4 pages of data (make sure you fetch all pages, each page costs 1 API call).
In practice, pulling Item Market data by Item Type (with 'ANY' bonus filter set) allows one API key to watch closer to 30 item types, which is usually around 2000 items, per minute.
If we had 2 API keys, we could scan these 2000 items every 30 seconds, instead of every 1 minute.
If we had 4 API keys, we could scan every 15 seconds.
And so on.
Who is doing this?
So first, I'll note that it can be hard to tell the difference between a buy-mug and a mugbot ping - in both cases, a person may be mugged right after a sale. With that said, these are the two I'm pretty confident on:
Shiny Hoard Avian Team is the clear leader on the scoreboard. These guys have the best mugbot right now, and almost always win the race if it's a sale they were tracking (and they usually are tracking, they seem to update multiple times a day). I've spoken with some of the people they mugged, and found it's not uncommon for them to hit within 15 seconds after the sale. This means they are polling quite frequently (perhaps every 10 seconds), which indicates they have a nice-sized pool of API keys they are using.
The Next Level also seem to have a mugbot that has a good coverage, but they get beat by Shiny Hoard a lot. I suspect they aren't polling as frequently (perhaps not as many API keys).
Why am I posting this?
Being competitive in the mugbot scene would require a bunch more API keys than I have - and would require me to continue manually browsing the item market each morning (which I loathe doing).
So I'm hoping I can convert this knowledge into forum karma instead.
How to Break Mugbots
A cache on this endpoint is needed:
https://api.torn.com/v2/market?selections=itemmarket&id={$itemTypeID}
Splent's aware, but says it's tricky:

Would you release your mugbot open source?
If we get a clear statement from Ched/Splent that they won't implement a cache / break mugbots, I'd be willing to release mine open source at that time so that at least everyone's on an even playing field [but frankly you could build one yourself with Github Copilot and the above info].
Who is buying all those Wind-up weapons?
IDFK. Some collector nut, probably.