在过去一年中,自动化威胁导致了 30%的 API 攻击。其中,17%是利用业务逻辑漏洞的恶意机器人,而 13%是其他类型的自动化威胁。业务逻辑攻击利用应用程序设计和实施中的缺陷,使攻击者能够操纵合法功能,并可能获得对敏感数据或用户帐户的访问权限。
API 的使用在不同应用程序和服务之间实现无缝通信的需求正在增加,使其成为软件开发的关键要素。由于它们
机器可读的特性,API 越来越容易受到恶意机器人攻击,缺乏对 API 流量的可见性使其难以检测。然而,API 的广泛使用也使其成为恶意机器人的一个有吸引力的目标。恶意机器人利用 API,这些 API 通常作为通往敏感数据的直接通道,使其容易受到业务逻辑滥用和欺诈的影响。API 增加了攻击面,为自动化攻击提供了更多的入口点。由于组织继续在很大程度上依赖 API,因此实施强有力的安全措施以防范这些复杂的威胁至关重要。
针对 API 的账户接管攻击占 Imperva 记录的所有 ATO 攻击的 44%44 \% ,而去年为 35%35 \% 。由于移动和网络应用程序的普及,API 的广泛采用使其成为攻击者寻求破坏用户账户的一个吸引入口。这些 API 处理关键的身份验证过程,使其成为理想的目标。然而,由于现代 IT 环境的复杂性和在线平台的互联特性,实施安全措施具有挑战性。因此,网络犯罪分子利用身份验证 API 中的漏洞,获得对用户账户的未经授权访问。他们使用诸如凭证填充、暴力攻击或 API 滥用等技术。针对身份验证 API 的账户接管攻击频率的增加突显了组织增强其 API 安全措施并保护其免受当今最复杂的自动化攻击的必要性。
航空公司面临的主要问题是大量未经许可访问其网络资产的抓取机器人。这些机器人来自各种来源,如在线旅行社(OTA)、聚合器和竞争对手。大量抓取航班信息的机器人造成了许多问题,包括损害商业洞察,如查询与预订比率,并增加第三方预订供应商的费用。去年,我们分享了一个航空公司的故事,该公司的搜索 API 被机器人大量抓取航班信息。这导致其第三方供应商每月产生超过 $500K\$ 500 \mathrm{~K} 的 API 请求费用。今年,我们看到类似的攻击针对其他航空公司。
恶意机器人使用各种技术来规避检测,其中之一是伪装成合法用户,通过向源报告自己为人类常用的网页或移动浏览器。他们通过使用浏览器自动化软件来实现这一点。这种技术在大多数恶意机器人中已变得普遍,尽管它曾经是一种先进的规避方法。有趣的是,过去十年中,恶意机器人中浏览器的流行趋势发生了变化,反映了人类用户偏好和其他帮助机器人规避检测的趋势的变化。例如,Internet Explorer 曾经是人类和恶意机器人中流行的浏览器,但现在不再如此。
A. 营销和电子商务活动通常会吸引更多的机器人,特别是在限量高需求产品发布期间。无论是最新的运动鞋、下一代游戏机,还是独家收藏品,为这些受欢迎的产品指定发布日期就像是给机器人发出了信号。这些自动化实体旨在在真正的客户之前获取商品,可能会垄断访问并破坏您的销售努力。加强您网站的防御以有效管理流量激增至关重要,确保您能够区分合法消费者和意图劫持产品发布的逃避机器人。实施先进的流量分析、实时机器人检测机制和强大的身份验证措施可以帮助保护您的平台,确保实际客户的公平访问。
B. 识别您网站上的潜在漏洞是有效的机器人管理策略的关键要素。某些网站功能特别容易受到恶意机器人活动的影响。例如,加入登录功能可能导致凭证填充和凭证破解攻击,攻击者利用被盗的凭证获得未经授权的访问权限。同样,结账表单的存在
保护暴露的 API 和移动应用程序与保护您的网站同样重要,这强调了需要一个全面的网络安全策略,涵盖所有数字接触点。仅仅关注您网站的安全是不够的。API 和移动应用程序通常作为您网络应用程序和敏感数据的入口,提供了额外的网络威胁向量。在这些平台上实施强有力的安全措施并在系统之间进行阻断对于减少漏洞至关重要。这种综合方法确保了对潜在攻击的统一防御机制,最大限度地降低通过任何数字入口对您的网络应用程序和关键数据的未经授权访问的风险。
BLOCK
End of Life more
than three years| BLOCK |
| :--- |
| End of Life more |
| than three years |
CAPTCHA 生命周期超过两年
CAPTCHA
End of Life more
than two years| CAPTCHA |
| :--- |
| End of Life more |
| than two years |
Chrome 版本
< 95<95
< 105<105
Firefox 版本
< 95<95
< 105<105
Safari 版本
< 13<13
< 14<14
Internet Explorer 版本
< 11<11
< 11<11
"BLOCK
End of Life more
than three years" "CAPTCHA
End of Life more
than two years"
Chrome Version < 95 < 105
Firefox Version < 95 < 105
Safari Version < 13 < 14
Internet Explorer Version < 11 < 11| | BLOCK <br> End of Life more <br> than three years | CAPTCHA <br> End of Life more <br> than two years |
| :--- | :--- | :--- |
| Chrome Version | $<95$ | $<105$ |
| Firefox Version | $<95$ | $<105$ |
| Safari Version | $<13$ | $<14$ |
| Internet Explorer Version | $<11$ | $<11$ |
4. 威胁减少:代理
恶意机器人使用代理服务来掩盖其活动的情况正在上升,攻击者利用这些服务模拟合法用户行为。通过利用批量 IP 服务的 IP 轮换,他们可以掩盖其真实来源,增加检测的难度。缓解这一威胁的战略方法包括限制来自已知批量 IP 数据中心的访问,显著减少僵尸网络流量渗透您网络的潜力。这类基于代理的攻击的显著来源包括数据中心和云服务提供商,如 Host Europe GmbH、Dedibox SAS、Digital Ocean、OVH SAS 和 Choopa, LLC。实施访问控制并监控来自这些实体的流量可以通过预先识别和阻止机器人生成的流量来增强您的安全态势,从而最小化与这些代理启用攻击相关的风险。
A. 在没有明确指标的情况下识别机器人流量是一项挑战,但特定模式通常暗示它们的存在。高跳出率和低转化率可能是非人类流量的明显迹象。此外,流量的突然无解释激增或针对特定 URL 的异常高请求数量通常表明机器人活动。监测这些异常情况使组织能够标记潜在的机器人流量,从而促进进一步调查和采取适当的应对措施以减轻不受欢迎的干扰。
B. 特定端点的流量突然激增可能表明机器人正在针对特定事件或操作。要评估这种激增是否由机器人驱动,请分析这种流量增加的来源。寻找模式,例如单个 IP 地址、一个 ISP 或特定 URL 产生的流量水平显著高于正常水平。识别这些来源可以提供明确的机器人活动证据,使您
采取针对性的行动。例如,如果流量主要来自单个 IP 或狭窄范围的 IP,这强烈表明存在自动访问尝试。这些洞察对于部署有效的反制措施以抵御机器人攻击至关重要,确保您的数字资产保持安全。
7. 监控流量
A. 在登录页面上定义您的失败登录尝试基线,然后监控异常或激增。设置警报,以便在发生任何情况时自动通知您。高级的“低而慢”的攻击不会触发用户或会话级别的警报,因此请确保设置全局阈值。
Loss of sales to competitors that scrape your prices, undercut them and beat you in the marketplace
Damaged reputation due to scraped data being used in a way that misrepresents the business's prices or products
The lifetime value of customers worsens
Impacts website performance| Loss of sales to competitors that scrape your prices, undercut them and beat you in the marketplace |
| :--- |
| Damaged reputation due to scraped data being used in a way that misrepresents the business's prices or products |
| The lifetime value of customers worsens |
| Impacts website performance |
转化率下降 你的 SEO 排名下降 无法解释的网站缓慢和停机(通常是由于激进的抓取工具造成的)
Declining conversion rates
Your SEO rankings drop
Unexplained website slowdowns and downtime (usually caused by aggressive scrapers)| Declining conversion rates |
| :--- |
| Your SEO rankings drop |
| Unexplained website slowdowns and downtime (usually caused by aggressive scrapers) |
所有显示定价的业务: - 零售 - 游戏 - 航空公司 - 旅行
All businesses that show pricing:
- Retail
- Gaming
- Airlines
- Travel| All businesses that show pricing: |
| :--- |
| - Retail |
| - Gaming |
| - Airlines |
| - Travel |
内容抓取
Content
Scraping| Content |
| :--- |
| Scraping |
使用机器人从网站提取内容和数据
由于您的业务内容或数据在其他地方发布,导致访问原始网站或购买您的产品或服务的人减少,从而造成收入损失 重复内容损害您的 SEO 排名 损害品牌声誉 影响网站性能
Loss of revenue due to your business's content or data being published elsewhere, leading to fewer people visiting the original site or purchasing your products or services
Duplicate content damages your SEO rankings
Damage to brand reputation
Impacts website performance| Loss of revenue due to your business's content or data being published elsewhere, leading to fewer people visiting the original site or purchasing your products or services |
| :--- |
| Duplicate content damages your SEO rankings |
| Damage to brand reputation |
| Impacts website performance |
您的内容出现在其他网站上 您的 SEO 排名下降 无法解释的网站缓慢和停机(通常是由于激进的抓取工具造成的)
Your content appears on other sites
Your SEO rankings drop
Unexplained website slowdowns and downtime (usually caused by aggressive scrapers)| Your content appears on other sites |
| :--- |
| Your SEO rankings drop |
| Unexplained website slowdowns and downtime (usually caused by aggressive scrapers) |
类似于价格抓取,但除此之外: - 招聘网站 - 分类信息 - 市场 - 财务 - 票务
Similar to Price Scraping, but in addition:
- Job boards
- Classifieds
- Marketplaces
- Finance
- Ticketing| Similar to Price Scraping, but in addition: |
| :--- |
| - Job boards |
| - Classifieds |
| - Marketplaces |
| - Finance |
| - Ticketing |
账户接管(即凭证填充,凭证破解)
使用机器人非法访问他人用户账户,通常通过暴力登录技术实现,例如凭证填充或凭证破解
The use of bots to gain illegal access to user accounts belonging to someone else
Usually achieved using brute force login techniques such as Credential Stuffing or Credential Cracking| The use of bots to gain illegal access to user accounts belonging to someone else |
| :--- |
| Usually achieved using brute force login techniques such as Credential Stuffing or Credential Cracking |
Direct impact on brand loyalty and reputation, negative PR
Customer frustration to due account lockout, data theft or dealing with fraudulent, increasing churn
Impacts website performance, availability, and reliability
Risk of noncompliance with data privacy regulations
Increased support and fraud costs| Direct impact on brand loyalty and reputation, negative PR |
| :--- |
| Customer frustration to due account lockout, data theft or dealing with fraudulent, increasing churn |
| Impacts website performance, availability, and reliability |
| Risk of noncompliance with data privacy regulations |
| Increased support and fraud costs |
Increase in failed login rates
Increase in customer account lockouts and customer service tickets
Increase in fraud (lost loyalty points, stolen credit cards, unauthorized purchases)
Increase in chargebacks| Increase in failed login rates |
| :--- |
| Increase in customer account lockouts and customer service tickets |
| Increase in fraud (lost loyalty points, stolen credit cards, unauthorized purchases) |
| Increase in chargebacks |
任何有登录页面的企业
"Bad Bot
Problem" Definition How it Hurts the Business Symptoms Targeted Industries
"Price
Scraping" The use of bots to illegally monitor and track pricing information, typically in order to undercut rivals and boost sales "Loss of sales to competitors that scrape your prices, undercut them and beat you in the marketplace
Damaged reputation due to scraped data being used in a way that misrepresents the business's prices or products
The lifetime value of customers worsens
Impacts website performance" "Declining conversion rates
Your SEO rankings drop
Unexplained website slowdowns and downtime (usually caused by aggressive scrapers)" "All businesses that show pricing:
- Retail
- Gaming
- Airlines
- Travel"
"Content
Scraping" The use of bots to extract content and data from a website "Loss of revenue due to your business's content or data being published elsewhere, leading to fewer people visiting the original site or purchasing your products or services
Duplicate content damages your SEO rankings
Damage to brand reputation
Impacts website performance" "Your content appears on other sites
Your SEO rankings drop
Unexplained website slowdowns and downtime (usually caused by aggressive scrapers)" "Similar to Price Scraping, but in addition:
- Job boards
- Classifieds
- Marketplaces
- Finance
- Ticketing"
Account Takeover (aka Credential Stuffing, Credential Cracking) "The use of bots to gain illegal access to user accounts belonging to someone else
Usually achieved using brute force login techniques such as Credential Stuffing or Credential Cracking" "Direct impact on brand loyalty and reputation, negative PR
Customer frustration to due account lockout, data theft or dealing with fraudulent, increasing churn
Impacts website performance, availability, and reliability
Risk of noncompliance with data privacy regulations
Increased support and fraud costs" "Increase in failed login rates
Increase in customer account lockouts and customer service tickets
Increase in fraud (lost loyalty points, stolen credit cards, unauthorized purchases)
Increase in chargebacks" Any business with a login page| Bad Bot <br> Problem | Definition | How it Hurts the Business | Symptoms | Targeted Industries |
| :---: | :---: | :---: | :---: | :---: |
| Price <br> Scraping | The use of bots to illegally monitor and track pricing information, typically in order to undercut rivals and boost sales | Loss of sales to competitors that scrape your prices, undercut them and beat you in the marketplace <br> Damaged reputation due to scraped data being used in a way that misrepresents the business's prices or products <br> The lifetime value of customers worsens <br> Impacts website performance | Declining conversion rates <br> Your SEO rankings drop <br> Unexplained website slowdowns and downtime (usually caused by aggressive scrapers) | All businesses that show pricing: <br> - Retail <br> - Gaming <br> - Airlines <br> - Travel |
| Content <br> Scraping | The use of bots to extract content and data from a website | Loss of revenue due to your business's content or data being published elsewhere, leading to fewer people visiting the original site or purchasing your products or services <br> Duplicate content damages your SEO rankings <br> Damage to brand reputation <br> Impacts website performance | Your content appears on other sites <br> Your SEO rankings drop <br> Unexplained website slowdowns and downtime (usually caused by aggressive scrapers) | Similar to Price Scraping, but in addition: <br> - Job boards <br> - Classifieds <br> - Marketplaces <br> - Finance <br> - Ticketing |
| Account Takeover (aka Credential Stuffing, Credential Cracking) | The use of bots to gain illegal access to user accounts belonging to someone else <br> Usually achieved using brute force login techniques such as Credential Stuffing or Credential Cracking | Direct impact on brand loyalty and reputation, negative PR <br> Customer frustration to due account lockout, data theft or dealing with fraudulent, increasing churn <br> Impacts website performance, availability, and reliability <br> Risk of noncompliance with data privacy regulations <br> Increased support and fraud costs | Increase in failed login rates <br> Increase in customer account lockouts and customer service tickets <br> Increase in fraud (lost loyalty points, stolen credit cards, unauthorized purchases) <br> Increase in chargebacks | Any business with a login page |
Decreased credibility of certain platforms and websites to bot accounts that are used to spam messages or amplify propaganda
Loss of revenue to bots that exploit new account promotion credits (money, points, free plays)
Metrics based on the number of user accounts or social media interactions that all originate from bots may lead to poor decision making| Decreased credibility of certain platforms and websites to bot accounts that are used to spam messages or amplify propaganda |
| :--- |
| Loss of revenue to bots that exploit new account promotion credits (money, points, free plays) |
| Metrics based on the number of user accounts or social media interactions that all originate from bots may lead to poor decision making |
新账户创建异常增加 评论垃圾信息增加 新账户转化为付费客户的转化率下降
Abnormal increases in new account creation
Increased comment spam
Drop in conversion rates from new accounts to paying customers| Abnormal increases in new account creation |
| :--- |
| Increased comment spam |
| Drop in conversion rates from new accounts to paying customers |
消息平台 - 社交媒体 - 约会网站 - 社区 注册促销滥用 - 游戏 - 财务
Messaging platforms
- Social media
- Dating sites
- Communities
Sign-up promotion abuse
- Gaming
- Finance| Messaging platforms |
| :--- |
| - Social media |
| - Dating sites |
| - Communities |
| Sign-up promotion abuse |
| - Gaming |
| - Finance |
Financial losses due to the businesses' liability for any fraudulent activity that occurs on their platforms: from costly chargebacks to lost revenue due to decreased consumer trust
Damaged brand reputation
Damages to the fraud score of the business
Increased customer service costs to process fraudulent chargebacks
Noncompliance with data privacy regulations (PCI-DSS, GDPR, etc.)| Financial losses due to the businesses' liability for any fraudulent activity that occurs on their platforms: from costly chargebacks to lost revenue due to decreased consumer trust |
| :--- |
| Damaged brand reputation |
| Damages to the fraud score of the business |
| Increased customer service costs to process fraudulent chargebacks |
| Noncompliance with data privacy regulations (PCI-DSS, GDPR, etc.) |
Any site with a
payment processor:
- Retail
- Nonprofit/Charities
- Airlines
- Travel
- Ticketing
- Finance
- Gaming| Any site with a |
| :--- |
| payment processor: |
| - Retail |
| - Nonprofit/Charities |
| - Airlines |
| - Travel |
| - Ticketing |
| - Finance |
| - Gaming |
拒绝服务
使用机器人通过请求淹没网站,导致文件系统、内存、进程、线程、CPU 以及人力或财力等资源的耗尽
减慢网站性能,导致停电或停机 网站不可用造成的收入损失 损害品牌声誉 潜在客户流失
Slows the website performance causing brownouts or downtime
Lost revenue from the unavailability of websites
Damaged brand reputation
Potential customer churn| Slows the website performance causing brownouts or downtime |
| :--- |
| Lost revenue from the unavailability of websites |
| Damaged brand reputation |
| Potential customer churn |
特定资源(登录、注册、产品页面等)上异常和无法解释的流量激增 客户服务投诉增加
Abnormal and unexplained spikes in traffic on particular resources (login, signup, product pages, etc.)
Increase in customer service complaints| Abnormal and unexplained spikes in traffic on particular resources (login, signup, product pages, etc.) |
| :--- |
| Increase in customer service complaints |
所有行业
礼品卡余额检查和滥用
Gift Card
Balance Checking and Abuse| Gift Card |
| :--- |
| Balance Checking and Abuse |
Similary to credit card fraud, gift card fraud leads to fininaial losses due to bots that steal money from gift cards
Increased customer service costs to process fraudulent chargebacks
Poor customer reputation and loss of future sales
Damaged brand reputation| Similary to credit card fraud, gift card fraud leads to fininaial losses due to bots that steal money from gift cards |
| :--- |
| Increased customer service costs to process fraudulent chargebacks |
| Poor customer reputation and loss of future sales |
| Damaged brand reputation |
礼品卡余额页面请求激增 关于丢失余额的客户服务电话增加
Spike in requests to the gift card balance page
Increase in customer service calls about lost balances| Spike in requests to the gift card balance page |
| :--- |
| Increase in customer service calls about lost balances |
任何提供礼品卡作为支付选项的企业 - 主要是零售
"Bad Bot
Problem" Deffinition How it Hurts the Business Symptoms Targeted Industries
"Account Creation
(aka Account Aggregation, New Account Fraud)" The use of bots to automate bulk account creation. These accounts can then be misused to perform various forms of fraud, spam content, or spread propaganda "Decreased credibility of certain platforms and websites to bot accounts that are used to spam messages or amplify propaganda
Loss of revenue to bots that exploit new account promotion credits (money, points, free plays)
Metrics based on the number of user accounts or social media interactions that all originate from bots may lead to poor decision making" "Abnormal increases in new account creation
Increased comment spam
Drop in conversion rates from new accounts to paying customers" "Messaging platforms
- Social media
- Dating sites
- Communities
Sign-up promotion abuse
- Gaming
- Finance"
"Credit
Card Fraud (aka Carding, Card Cracking)" The use of bots to mass-verify the validity of stolen credit card numbers or guess the missing details (CVV, expiration date, etc.) "Financial losses due to the businesses' liability for any fraudulent activity that occurs on their platforms: from costly chargebacks to lost revenue due to decreased consumer trust
Damaged brand reputation
Damages to the fraud score of the business
Increased customer service costs to process fraudulent chargebacks
Noncompliance with data privacy regulations (PCI-DSS, GDPR, etc.)" Rise in credit card fraud Increase in customer support calls Increased chargebacks processed "Any site with a
payment processor:
- Retail
- Nonprofit/Charities
- Airlines
- Travel
- Ticketing
- Finance
- Gaming"
Denial-ofService The use of bots to overwhelm a website with requests, leading to an exhaustion of resources such as file system, memory, processes, threads, CPU, and human or financial resources "Slows the website performance causing brownouts or downtime
Lost revenue from the unavailability of websites
Damaged brand reputation
Potential customer churn" "Abnormal and unexplained spikes in traffic on particular resources (login, signup, product pages, etc.)
Increase in customer service complaints" All industries
"Gift Card
Balance Checking and Abuse" The use of bots to automate the enumeration of potential gift card numbers against balance checking pages to steal gift card balances "Similary to credit card fraud, gift card fraud leads to fininaial losses due to bots that steal money from gift cards
Increased customer service costs to process fraudulent chargebacks
Poor customer reputation and loss of future sales
Damaged brand reputation" "Spike in requests to the gift card balance page
Increase in customer service calls about lost balances" Any business offering gift cards as a payment option - Retail predominantly| Bad Bot <br> Problem | Deffinition | How it Hurts the Business | Symptoms | Targeted Industries |
| :---: | :---: | :---: | :---: | :---: |
| Account Creation <br> (aka Account Aggregation, New Account Fraud) | The use of bots to automate bulk account creation. These accounts can then be misused to perform various forms of fraud, spam content, or spread propaganda | Decreased credibility of certain platforms and websites to bot accounts that are used to spam messages or amplify propaganda <br> Loss of revenue to bots that exploit new account promotion credits (money, points, free plays) <br> Metrics based on the number of user accounts or social media interactions that all originate from bots may lead to poor decision making | Abnormal increases in new account creation <br> Increased comment spam <br> Drop in conversion rates from new accounts to paying customers | Messaging platforms <br> - Social media <br> - Dating sites <br> - Communities <br> Sign-up promotion abuse <br> - Gaming <br> - Finance |
| Credit <br> Card Fraud (aka Carding, Card Cracking) | The use of bots to mass-verify the validity of stolen credit card numbers or guess the missing details (CVV, expiration date, etc.) | Financial losses due to the businesses' liability for any fraudulent activity that occurs on their platforms: from costly chargebacks to lost revenue due to decreased consumer trust <br> Damaged brand reputation <br> Damages to the fraud score of the business <br> Increased customer service costs to process fraudulent chargebacks <br> Noncompliance with data privacy regulations (PCI-DSS, GDPR, etc.) | Rise in credit card fraud Increase in customer support calls Increased chargebacks processed | Any site with a <br> payment processor: <br> - Retail <br> - Nonprofit/Charities <br> - Airlines <br> - Travel <br> - Ticketing <br> - Finance <br> - Gaming |
| Denial-ofService | The use of bots to overwhelm a website with requests, leading to an exhaustion of resources such as file system, memory, processes, threads, CPU, and human or financial resources | Slows the website performance causing brownouts or downtime <br> Lost revenue from the unavailability of websites <br> Damaged brand reputation <br> Potential customer churn | Abnormal and unexplained spikes in traffic on particular resources (login, signup, product pages, etc.) <br> Increase in customer service complaints | All industries |
| Gift Card <br> Balance Checking and Abuse | The use of bots to automate the enumeration of potential gift card numbers against balance checking pages to steal gift card balances | Similary to credit card fraud, gift card fraud leads to fininaial losses due to bots that steal money from gift cards <br> Increased customer service costs to process fraudulent chargebacks <br> Poor customer reputation and loss of future sales <br> Damaged brand reputation | Spike in requests to the gift card balance page <br> Increase in customer service calls about lost balances | Any business offering gift cards as a payment option - Retail predominantly |
Loss of revenue from unsold items that are held in shopping carts by bots
Lower conversion rates
Increased cart abandonment rates
Damaged customer reputation because unscrupulous middlemen hold all inventory until resold elsewhere| Loss of revenue from unsold items that are held in shopping carts by bots |
| :--- |
| Lower conversion rates |
| Increased cart abandonment rates |
| Damaged customer reputation because unscrupulous middlemen hold all inventory until resold elsewhere |
购物车中被遗弃物品的增加 转化率的下降 客户对库存缺乏可用性的投诉增加
Increase in abandoned items held in shopping carts
Decrease in conversion rates
Increase in customer complaints about lack of availability of inventory| Increase in abandoned items held in shopping carts |
| :--- |
| Decrease in conversion rates |
| Increase in customer complaints about lack of availability of inventory |
Damaged customer reputation
Slows the website performance causing brownouts or downtime, leading to loss of revenue
Lower lifetime value (LTV), because a bot doesn't regularly come back for additional items
Lower average basket value (ABV), because bots target a single product as opposed to legitimate consumers who tend to purchase additional items| Damaged customer reputation |
| :--- |
| Slows the website performance causing brownouts or downtime, leading to loss of revenue |
| Lower lifetime value (LTV), because a bot doesn't regularly come back for additional items |
| Lower average basket value (ABV), because bots target a single product as opposed to legitimate consumers who tend to purchase additional items |
Unexplained website slowdowns and downtime (usually caused by aggressive scalping bots)
Decrease in conversion rates
Increase in customer complaints about lack of availability of inventory| Unexplained website slowdowns and downtime (usually caused by aggressive scalping bots) |
| :--- |
| Decrease in conversion rates |
| Increase in customer complaints about lack of availability of inventory |
Similar to Denial of Inventory:
- Airlines
- Tickets
- Retail
e.g. sneakers, consoles, computer hardware, limited edition items.
- Healthcare| Similar to Denial of Inventory: |
| :--- |
| - Airlines |
| - Tickets |
| - Retail |
| e.g. sneakers, consoles, computer hardware, limited edition items. |
| - Healthcare |
座椅 旋转
Seat
Spinning| Seat |
| :--- |
| Spinning |
使用机器人在不付款的情况下占用航班座位,通常长达 24 小时
未售座位的收入损失 因为合法消费者无法预订所需航班而造成的声誉损害
Loss of revenue for unsold seats
Reputation damage because legitimate consumers cannot book desired flights| Loss of revenue for unsold seats |
| :--- |
| Reputation damage because legitimate consumers cannot book desired flights |
随着出发时间临近,似乎已满的航班突然显示出越来越多的空座位
航空公司
"Bad Bot
Problem" Definition How it Hurts the Business Symptoms Targeted Industries
Denial of Inventory The use of bots to hold items in shopping carts without ever actually completing the purchase, thus denying them from legitimate consumers "Loss of revenue from unsold items that are held in shopping carts by bots
Lower conversion rates
Increased cart abandonment rates
Damaged customer reputation because unscrupulous middlemen hold all inventory until resold elsewhere" "Increase in abandoned items held in shopping carts
Decrease in conversion rates
Increase in customer complaints about lack of availability of inventory" "Businesses offering scarce or timesensitive items:
- Airlines
- Tickets
- Retail
- Healthcare"
Scalping The use of bots to gain an unfair advantage over legitimate consumers and obtain limitedavailability and/or preferred goods/ services "Damaged customer reputation
Slows the website performance causing brownouts or downtime, leading to loss of revenue
Lower lifetime value (LTV), because a bot doesn't regularly come back for additional items
Lower average basket value (ABV), because bots target a single product as opposed to legitimate consumers who tend to purchase additional items" "Unexplained website slowdowns and downtime (usually caused by aggressive scalping bots)
Decrease in conversion rates
Increase in customer complaints about lack of availability of inventory" "Similar to Denial of Inventory:
- Airlines
- Tickets
- Retail
e.g. sneakers, consoles, computer hardware, limited edition items.
- Healthcare"
"Seat
Spinning" The use of bots to hold flight seats without making a payment, often up to 24 hours "Loss of revenue for unsold seats
Reputation damage because legitimate consumers cannot book desired flights" As departure time approaches, seemingly fully booked flights are suddenly showing increasing numbers of empty seats Airlines| Bad Bot <br> Problem | Definition | How it Hurts the Business | Symptoms | Targeted Industries |
| :---: | :---: | :---: | :---: | :---: |
| Denial of Inventory | The use of bots to hold items in shopping carts without ever actually completing the purchase, thus denying them from legitimate consumers | Loss of revenue from unsold items that are held in shopping carts by bots <br> Lower conversion rates <br> Increased cart abandonment rates <br> Damaged customer reputation because unscrupulous middlemen hold all inventory until resold elsewhere | Increase in abandoned items held in shopping carts <br> Decrease in conversion rates <br> Increase in customer complaints about lack of availability of inventory | Businesses offering scarce or timesensitive items: <br> - Airlines <br> - Tickets <br> - Retail <br> - Healthcare |
| Scalping | The use of bots to gain an unfair advantage over legitimate consumers and obtain limitedavailability and/or preferred goods/ services | Damaged customer reputation <br> Slows the website performance causing brownouts or downtime, leading to loss of revenue <br> Lower lifetime value (LTV), because a bot doesn't regularly come back for additional items <br> Lower average basket value (ABV), because bots target a single product as opposed to legitimate consumers who tend to purchase additional items | Unexplained website slowdowns and downtime (usually caused by aggressive scalping bots) <br> Decrease in conversion rates <br> Increase in customer complaints about lack of availability of inventory | Similar to Denial of Inventory: <br> - Airlines <br> - Tickets <br> - Retail <br> e.g. sneakers, consoles, computer hardware, limited edition items. <br> - Healthcare |
| Seat <br> Spinning | The use of bots to hold flight seats without making a payment, often up to 24 hours | Loss of revenue for unsold seats <br> Reputation damage because legitimate consumers cannot book desired flights | As departure time approaches, seemingly fully booked flights are suddenly showing increasing numbers of empty seats | Airlines |
行业中的恶意机器人
行业
包括哪些企业?
坏机器人做什么?
汽车
汽车租赁、制造商、经销商、车辆市场
价格抓取,数据抓取,库存检查
商业服务
房地产,第三方供应商如零售平台,客户关系管理系统,商业指标
针对 API 的攻击、数据抓取、账户接管
计算与信息技术
IT 服务,IT 供应商,服务和技术供应商
账户接管,抓取
教育
在线学习平台,学校,学院,大学
学生和教职员工的账户接管、课程可用性、抓取专有研究论文和数据
娱乐
流媒体服务,票务平台,制作公司,场馆
账户接管,价格抓取,库存抓取,抢购
金融服务
银行、保险、投资、加密货币
账户接管,卡片欺诈,卡片破解,自定义内容抓取
食品和杂货
食品配送服务,在线杂货购物,食品和饮料品牌网站
信用卡欺诈,礼品卡欺诈,账户接管
赌博
在线游戏,赌场,体育博彩
账户接管,赔率抓取,促销滥用的账户创建
政府
法律与政府网站,公民服务,州,市,大都市
账户接管、商业注册列表的数据抓取、选民注册、预约抓取和调度
医疗保健
健康服务,药店
账户接管,内容抓取,“有用”的机器人抓取预约可用性
生活方式
生活方式杂志,博客
专有内容抓取
市场营销
营销机构,广告机构
专有内容抓取,广告欺诈,拒绝服务,偏斜
新闻
新闻网站,在线杂志
专有内容抓取,广告欺诈,评论垃圾邮件
零售
电子商务,市场,分类信息
账户接管,剥头皮,库存拒绝,信用卡欺诈,礼品卡欺诈,数据和价格抓取,分析偏差
社区与社会
非营利组织、信仰与信念、浪漫与关系、在线社区、LGBTQ、家谱
内容和数据抓取,账户接管,账户创建,在捐赠页面上测试被盗信用卡
体育
体育更新,新闻,实时比分服务
数据抓取(实时比分、赔率等)
电信与互联网服务提供商
电信服务提供商,移动互联网服务提供商,托管服务提供商
账户接管,竞争价格抓取
旅行
航空公司,酒店,假期预订
价格和数据抓取,预订比率的扭曲,拒绝服务,价格抓取,账户接管,座位旋转
Industry What Businesses are Included? What Bad Bots do?
Automotive Car Rentals, Manufacturers, Dealerships, Vehicle Marketplaces Price Scraping, Data Scraping, Inventory Checking
Business Services Real Estate, Third Party Vendors Like Retail Platforms, CRM Systems, Business Metrics Attacks Targeting Apis, Data Scraping, Account Takeover
Computing & IT It Services, It Providers, Services and Technology Providers Account Takeover, Scraping
Education Online Learning Platforms, Schools, Colleges, Universities Account Takeover For Students and Faculty, Class Availability, Scraping Proprietary Research Papers and Data
Entertainment Streaming Services, Ticketing Platforms, Production Companies, Venues Account Takeover, Price Scraping, Inventory Scraping, Scalping
Financial Services Banking, Insurance, Investments, Cryptocurrency Account Takeover, Carding, Card Cracking, Custom Content Scraping
Food & Groceries Food Delivery Services, Online Grocery Shopping, Food & Beverage Brand Sites Credit Card Fraud, Gift Card Fraud, Account Takeover
Gambling Online Gaming, Casinos, Sport Betting Account Takeover, Odds Scraping, Account Creation For Promotion Abuse
Government Law & Government Websites, Citizen Services, States, Municipalities, Metropolitans Account Takeover, Data Scraping Of Business Registrations Listings, Voter Registration, Appointment Scraping and Scheduling
Healthcare Health Services, Pharmacies Account Takeover, Content Scraping, "Helpful" Bots That Scrape For Appointment Availability
Lifestyle Lifestyle Magazines, Blogs Proprietary Content Scraping
Marketing Marketing Agencies, Advertising Agencies Proprietary Content Scraping, Ad Fraud, Denial-Of-Service, Skewing
News News Sites, Online Magazines Proprietary Content Scraping, Ad Fraud, Comment Spam
Retail Ecommerce, Marketplaces, Classifieds Account Takeover, Scalping, Denial of Inventory, Credit Card Fraud, Gift Card Fraud, Data and Price Scraping, Analytics Skewing
Community & Society Nonprofits, Faith and Beliefs, Romance and Relationships, Online Communities, LGBTQ, Genealogy Content and Data Scraping, Account Takeover, Account Creation, Testing Stolen Credit Cards on Donation Pages
Sports Sports Updates, News, Live Score Services Data Scraping (Live Scores, Odds Etc.)
Telecom & ISPs Telecommunications Providers, Mobile Isps, Hosting Providers Account Takeover, Competitive Price Scraping
Travel Airlines, Hotels, Holiday Booking Price And Data Scraping, Skewing Of Look-To-Book Ratio, Denial-Of-Service, Price Scraping, Account Takeover, Seat Spinning| Industry | What Businesses are Included? | What Bad Bots do? |
| :---: | :---: | :---: |
| Automotive | Car Rentals, Manufacturers, Dealerships, Vehicle Marketplaces | Price Scraping, Data Scraping, Inventory Checking |
| Business Services | Real Estate, Third Party Vendors Like Retail Platforms, CRM Systems, Business Metrics | Attacks Targeting Apis, Data Scraping, Account Takeover |
| Computing & IT | It Services, It Providers, Services and Technology Providers | Account Takeover, Scraping |
| Education | Online Learning Platforms, Schools, Colleges, Universities | Account Takeover For Students and Faculty, Class Availability, Scraping Proprietary Research Papers and Data |
| Entertainment | Streaming Services, Ticketing Platforms, Production Companies, Venues | Account Takeover, Price Scraping, Inventory Scraping, Scalping |
| Financial Services | Banking, Insurance, Investments, Cryptocurrency | Account Takeover, Carding, Card Cracking, Custom Content Scraping |
| Food & Groceries | Food Delivery Services, Online Grocery Shopping, Food & Beverage Brand Sites | Credit Card Fraud, Gift Card Fraud, Account Takeover |
| Gambling | Online Gaming, Casinos, Sport Betting | Account Takeover, Odds Scraping, Account Creation For Promotion Abuse |
| Government | Law & Government Websites, Citizen Services, States, Municipalities, Metropolitans | Account Takeover, Data Scraping Of Business Registrations Listings, Voter Registration, Appointment Scraping and Scheduling |
| Healthcare | Health Services, Pharmacies | Account Takeover, Content Scraping, "Helpful" Bots That Scrape For Appointment Availability |
| Lifestyle | Lifestyle Magazines, Blogs | Proprietary Content Scraping |
| Marketing | Marketing Agencies, Advertising Agencies | Proprietary Content Scraping, Ad Fraud, Denial-Of-Service, Skewing |
| News | News Sites, Online Magazines | Proprietary Content Scraping, Ad Fraud, Comment Spam |
| Retail | Ecommerce, Marketplaces, Classifieds | Account Takeover, Scalping, Denial of Inventory, Credit Card Fraud, Gift Card Fraud, Data and Price Scraping, Analytics Skewing |
| Community & Society | Nonprofits, Faith and Beliefs, Romance and Relationships, Online Communities, LGBTQ, Genealogy | Content and Data Scraping, Account Takeover, Account Creation, Testing Stolen Credit Cards on Donation Pages |
| Sports | Sports Updates, News, Live Score Services | Data Scraping (Live Scores, Odds Etc.) |
| Telecom & ISPs | Telecommunications Providers, Mobile Isps, Hosting Providers | Account Takeover, Competitive Price Scraping |
| Travel | Airlines, Hotels, Holiday Booking | Price And Data Scraping, Skewing Of Look-To-Book Ratio, Denial-Of-Service, Price Scraping, Account Takeover, Seat Spinning |