Bad bot operators changing tactics, says vendor report

Automated application layer attacks by bots have long been used by criminals, particularly with the expansion of internet-connected devices such as surveillance cameras with low security.

However, a new report from security vendor Imperva warns some bot operators are expanding their sights by rebranding their operations as business intelligence companies selling scraped data. These operators are hiring professional data extraction experts and investing in new techniques to evade detection.

“Bad bots are trying to improve their image and appear legitimate,” Imperva says in its seventh annual report. It says so-called “bad” bots do everything from web scraping without permission, competitive data mining, personal and financial data harvesting, brute-force login, digital ad fraud, spam, transaction fraud, and more.

Source countries of bad bots. Source: Imperva

The biggest problem with bots is they are behind credential stuffing and brute force attacks. However, the report adds that not all bad bots are run by criminals. Some legitimate businesses scrape publicly-available data from competitors’ web sites for pricing or job-filling purposes. Others are in a murky world that may cross into price-fixing by, for example, buying event tickets from a competitor’s web site, buying up stocks of limited edition running shoes or trying to influence an election through spreading misinformation.

With such a wide definition, it’s no surprise that Imperva says the U.S. remains the “bad bot superpower” with nearly 46 per cent of bad bot traffic coming from the country. The Netherlands is the third-largest source with eight per cent, followed by Canada with 6.3 per cent.

“Good” bots, Imperva says, ensure that prospective customers can find online businesses and their products. Examples include search engine crawlers such as GoogleBot and Bingbot that, through their indexing, help people match their queries with the most relevant sets of websites

By Imperva’s definition, bad bots accounted for 24 per cent of all web traffic in 2019, up six per cent from 2018. Of that number 73.7 per cent are what Imperva calls advanced persistent bots that cycle through random IP addresses, enter through anonymous proxies, change their identities and mimic human behaviour.

Good bots made up 13 per cent of all web traffic last year.

The top five industries with the most bad bot traffic include financial services (47.7 per cent), education (45.7 per cent), IT and services (45.1 per cent), marketplaces (39.8 per cent), and government (37.5 per cent).

To combat bad bots Imperva says CIOs/CISOs should:

  • Because bad bots disguise their identity by reporting their user agent as a web browser to avoid detection, block, or CAPTCHA outdated user agents and browsers, like Internet Explorer, Chrome, Firefox and Safari
  • Block traffic from known bot hosting and proxy services such as Digital Ocean, Gignet, OVH Hosting and Choopa LLC. The report says Amazon is the biggest source of bad bots. However, the proportion dropped to 11.6 percent in 2019 from 18 per cent the previous year
  • Protect exposed APIs and mobile apps—not just your website—and share blocking information between systems wherever possible. Protecting your website does little good if backdoor paths remain open, says the report;
  • Monitor traffic sources carefully for suspicious signs such as high bounce rates and lower conversion rates from certain traffic sources, traffic spikes and failed login attempts;
  • Retailers should watch for an increase in failures, or even traffic, to gift card validation pages. These can be a signal that
    bots such as GiftGhostBot are attempting to steal gift card balances.

The full report is available here. Registration is required.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@]

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now