Press Release
As consumers head online to get the best deals in the run up to Christmas and during the January sales, research from Radware, a web application security expert, reveals it could be in vain, thanks to so called ‘Jingle Bots’ playing havoc.
An in-depth look at internet traffic on Cyber Monday and Black Friday shows that only a third of shoppers were real people. The rest were automated bots designed to disrupt the smooth running and revenues of eCommerce sites by jamming them with fake shoppers so genuine shoppers give up or shop elsewhere.
Nick-named ‘Jingle bots’, these internet bots disguised as bone-fide shoppers because they behave just as people would, made up 90% of the shopping carts over Black Friday / Cyber Monday. Their goal was to put thousands of items into their shopping baskets making the stock unavailable to genuine shoppers, or even redirect them to a competitor’s site. As a result, cart abandonments were much higher this year, caused by bots with no intention of checking out.
The study, which reviewed millions and millions of transactions from across the world, also found that 45% of traffic on product pages was made up of bots, carrying out a form of corporate espionage, namely to scrape the product information and pricing details from competitor sites. The tactic is becoming more common as a way to snoop on pricing and automatically put in place better deals to win customers.
There are many reasons why bots are used in this way. Some are nation state attacks intended to disrupt an economy. Other hackers are doing it to make money, by scraping the inventory to later sell on the black market at a profit, and it’s not unheard of for some companies to target competitors so they can price check and ensure they always win on price deals.
It’s expected Jingle Bots will continue over Christmas and into the January sales. As a result, Pascal Geenens, security researcher at Radware, is warning shoppers and retailers to beware:
“If you intend to buy presents online and see a low stock figure on an item it’s probably because bots are holding up stock. It’s worth checking back as the stock could change over the course of the day. You’ll notice more and more sites will set a time limit on your check out to try and ensure stock gets to genuine customers and prevent their warehouses from being brought to a stand-still. These sites are actively managing things so it’s a good sign they are working on preventing bots from causing chaos.”
“That said, being able to spot a bad bot isn’t easy for retailers and the high number of abandoned carts illustrates how difficult it is. In fact, our studies show that around 80% of companies say they can’t spot the difference between good and bad bots. That’s quite a problem when you consider some sites can see as many as 2,000 bots hit their website a minute. This research shows how important it is to put bot detection in place and measures to prevent them from infiltrating your sales platform.”
Pascal adds that there are tell-tale signs of bad bot attacks: “It certainly pays off to actively look at web performance and retailers should be paying particular attention to the warning signs. Abnormal spikes in traffic, high bounce rates, IP addresses with suspicious origins, and slower performance of the site overall all add up to unwanted bad bot traffic.”
But there is another dimension to the attacks that retailers need to be aware, namely ‘click bots’, as Pascal explains: “We are seeing more click bots these days. These bots take advantage of the adverts marketing teams run online and will deliberately use the links in adverts to get into a website.
“This not only floods the site with fake customers, but also costs the marketing team money because the investment they make in running the online ads isn’t converting into sales but unwanted traffic that ruins the customer experience. Marketing teams need to analyse their figures carefully and work with the security team to ensure money is well placed and their efforts aren’t thwarted.”
For more information on how to detect bots go to:
