What is a bot?

A bot is a software program that operates on the Internet and performs repetitive tasks. While some bot traffic is from good bots, bad bots can negatively impact a website or application.

A bot is a software application that is programmed to do specific tasks. Bots are automated, which means they run according to their instructions without a human user needing to start them up every time. Bots often imitate or replace a human user’s behavior. Typically, they do repetitive tasks, and they can do them much faster than human users could.

Bots usually operate over a network; over half of Internet traffic is bots scanning content, interacting with webpages, chatting with users, or looking for attack targets. Some bots are helpful, such as search engine bots that index content for search or customer service bots that help users. Other bots are “bad” and are programmed to break into user accounts, scan the web for contact information for sending spam, or perform other malicious activities. A bot will have an associated IP address if connected to the Internet.

Bots can be:

Chatbots: Bots that simulate human conversation by responding to specific phrases with programmed responses
Web crawlers (Googlebots): Bots that scan content on webpages all over the Internet
Social bots: Bots that operate on social media platforms
Malicious bots: Bots that scrape content, spread spam content, or carry out credential-stuffing attacks

What is malicious bot activity?

Any automated actions by a bot that violate a website owner’s intentions, the site’s Terms of Service, or the site’s Robots.txt rules for bot behavior can be considered malicious. Bots that attempt to carry out cybercrime, such as identity theft or account takeover, are also “bad” bots. While some of these activities are illegal, bots do not have to break any laws to be considered malicious.

In addition, excessive bot traffic can overwhelm a web server’s resources, slowing or stopping service for legitimate human users trying to use a website or an application. Sometimes, this is intentional and takes the form of a DoS or DDoS attack.

Malicious bot activity includes:

Credential stuffing
Web/content scraping
DoS or DDoS attacks
Brute force password cracking
Inventory hoarding
Spam content
Email address harvesting
Click fraud

To carry out these attacks and disguise the source of the attack traffic, bad bots may be distributed in a botnet, meaning copies of the bot are running on multiple devices, often without the knowledge of the device owners. Because each device has its IP address, botnet traffic comes from tons of different IP addresses, making it more challenging to identify and block the source of the malicious bot traffic.