Malicious bots and botnets: What they do and how to stop them
How bots and botnets differ, the attacks they run on web apps and APIs (scraping, account takeover, form abuse, DDoS), and how scoring each request stops them.
On this page
Financial services companies are a favourite target for bot operators, and the attacks have grown with the botnets behind them. Four uses dominate: credit card fraud, account takeover, distributed denial of service, and scraping of content and prices. Each one lands on the business differently, and the defences differ too.
Bots and botnets
What a bot is
A bot is a small program that makes web requests on its own. Bots index websites, answer support chats, and test stolen card numbers at checkout; the software is the same, the intent is not. When people say "bot attack" they mean the hostile kind.
What a bot attack is
A bot attack uses automated requests to deceive, defraud or disrupt a website, application, API or its users. What began as spam has become an industry, with its own suppliers, marketplaces and infrastructure.
What a botnet is
A botnet ("robot network") is a large set of computers and connected devices infected with malware and run by one operator. A command-and-control channel lets the operator steer every device remotely, push updates to the malware, and change what the bots do within minutes. The more infected devices, the more the botnet can do: flood a service, spray passwords, or probe for a way into systems that matter.
What a botnet attack is
A botnet attack is any attack run through those infected machines, now "zombies" working for the controller. It is more dangerous than malware that sits on one computer because the operator can do many things at once and from many places, more like an intruder inside the network than a single infected file.
Botnets scale and change on command. The malware usually carries its own network communication, so the operator can coordinate with other criminals across the infected fleet, recruit more devices, and spread further. Some botnet attacks are the goal; others are the setup for the next one.
Bot attacks vs botnet attacks
A botnet attack is one kind of bot attack. "Bot attack" covers any use of automated requests to harm a site, application or device, from one script on one server to a million-device flood.
The step from spam to fraud at scale was made easier by open-source botkits: ready-made tools for building bots, handed around free online or on dark web forums.
With a botkit you can scrape a site, hijack accounts, abuse forms and, with enough infected devices, run a DDoS.
What bot attacks go after
Bots attack web applications and APIs to steal or alter data. These are the common scenarios.
Web content scraping
Scraper bots copy content from a site automatically. Many pose as search engine crawlers while they do it, and take text, prices and code without the owner knowing.
Real crawlers announce themselves. Googlebot and Bingbot carry a known user agent string and respect robots.txt, because their job is to index your pages for search results. A "crawler" that ignores robots.txt is something else.
Scraped material includes text, images, HTML and CSS, metadata and product data. What it gets used for:
- republishing paywalled news stories or copyrighted programmes
- syndicating blog posts to steal organic traffic and search ranking
- harvesting inventory and price data to undercut a competitor
- collecting contact details to sell as sales leads
- copying a site's HTML to build a phishing clone of the brand
Account takeover
Breaches put large credential dumps on sale on the dark web. Bots then test those usernames and passwords against the login forms of commercial sites at speed, which is credential stuffing.
Each pair that works gives the attacker an account. They lock out the real owner, pull personal data and stored payment methods, and spend them: new credit card accounts opened in the victim's name, purchases on the saved card, and whatever else the account gives access to.
Form submission abuse
Any form is input the server has to handle, which makes it a target. Bots use forms to probe for SQL injection, to scan for weaknesses, to post spam or offensive content, and to plant links that infect the users who click them. Client-side JavaScript validation is no barrier; the bot never runs it.
Why botnet attacks keep growing
More connected devices means more recruits. One widely quoted estimate puts more than 31 billion IoT devices in use worldwide: home appliances, lighting, door locks, cameras, thermostats, smart plugs and digital assistants at home, plus the fleets in hospitals and critical infrastructure. Any of them can be made a zombie, and keeping them out of a botnet is the first step in not being hit by one.
Every device on the internet is reachable, and the more there are, the larger the surface.
Two things feed the growth: IoT devices shipped with weak defaults and left misconfigured, and staff reaching company networks from personal devices on home connections.
The most common botnet attacks
1. Brute force
When the attacker does not have the password, the botnet guesses it: fast, repeated attempts straight against the login service, with each response telling the malware whether to keep going. Leaked credentials and personal details about the target feed the guesses.
2. Distributed denial of service
The most familiar botnet attack. Thousands of devices flood a service with traffic until it slows or falls over. In 2016 the Mirai botnet took down Dyn, a DNS provider, in two waves, and sites that depended on it, Twitter and SoundCloud among them, went dark for users in some regions.
3. Spam and phishing
Botnets send the spam that carries phishing mail, which tricks staff into handing over data or credentials. The same mail recruits new devices into the botnet.
4. Device bricking
In some campaigns the bots wipe the devices they ran on. A bricked device no longer works at all, and the wipe usually serves to destroy evidence of the main attack.
How to stop bot attacks on your site
The common thread in every scenario above is a request that looks valid on its own and wrong in context: a login with the right password from a device the account has never used, a signup from a browser that never runs JavaScript, a checkout form filled faster than a hand can type.
Sensfrx scores each signup, login and payment from device, network and behaviour signals in real time, and your rules decide whether to allow, review or block it. Each decision keeps the device, IP, location and time behind it, so you can see why a request was held. Integration is through plugins for WooCommerce, Shopify, WHMCS, Blesta and WISECP, or the REST API for anything else.
Start by separating good bots from bad bots in your own traffic, then put scoring on the three forms that matter most: signup, login and checkout. How the scoring works is on the bot attack prevention page.