20 Percent Of All Web Traffic Is Just 'Bad Bots,' And They Do Everything From Spam To Hacking

Bots can be invaluable for people doing analytics online, or even automating functions for daily use.

But bad bots are a major problem when it comes to DDoS attacks, scraping private data, and even push fake news. And it turns out, there are a lot of them.

According to a new report by Distil Networks, titled 'Bad Bot Report 2019', bots in general make up about 37.9 percent of all Internet traffic. That's fine one its own, but there's a deeper issue. Apparently one in five website requests, or roughly 20.4 percent, of all web traffic in 2018 was solely these bad bots.

It turns out the financial industry was the biggest target of these bad bots, followed by ticketing, education sector, government websites, and gambling. Of these bad bots, simple bots accounted for 26.4 percent of their traffic. These are bots that are easy to detect and defend against. Unfortunately, 52.5 percent of them came from what are considered "moderately" advanced, with the ability to use browser software as well as JavaScript for illegal activities.

A total of 73.6 percent of bad bots are classified as Advanced Persistent Bots (APBs), which are capable of routing through random IP addresses, switching their signatures, and behaving in a way that makes it look like human traffic. For instance, some of these bots were able to mimic mouse events on a domain like a human, which is to say they rolled over and clicked items in the way a regular person would. These allow them to blend in with regular traffic as they try to brute-force hack online accounts, mine for data, fake ad views, and conduct phishing campaigns.

Apparently Amazon is the biggest ISP source of bad bot traffic, with 18 percent of their traffic coming from the firm's servers, up from 10.62 in 2017. Meanwhile, close to half of all bad bots use Google Chrome as their medium. And these bad bots are most-generated from the US, followed by the Netherlands and China.

"Bot operators and bot defenders are playing an incessant game of cat and mouse, and techniques used today, such as mimicking mouse movements, are more human-like than ever before," said Tiffany Olson Kleemann, CEO of Distil Networks. "As sophistication strengthens, so too does the breadth of industries impacted by bad bots. When critical online activity, like voter registration, can be compromised as a result of bad bot activity, it no longer becomes a challenge to tackle tomorrow. Now is the time to understand what bots are capable of and now is the time to act."

To put into perspective just how bad bots can be, remember that Russia's alleged fake news campaign during the elections where Trump was voted in was largely carried out by bots. These malicious programs could also be used to influence public votes, like the Brexit referendum for instance, or petitions against Internet freedom.