Bot Traffic in 2023: Are We Winning the Fight? [Propeller x Voluum]
This post is also available in:
PT 
ES
This post was prepared by our friends at Voluum - experts in ad tracking software.
Bot traffic affects advertisers, publishers, and visitors in different but negative ways. The year 2023 didn’t change much in this regard: bot traffic is a continuous problem that marketers need to account for when planning their campaigns.
But the good news is that we won’t lose the war. Bots are like parasites: they can’t live without the host. Although most calculations say that bot traffic accounts for half of internet traffic, it will never reach 100% for obvious reasons. There will never come a time of an abandoned internet, filled with bots clicking links on websites generated by other bots.
There’s no money in that scenario.
The fight will continue. Bots will be mitigated to keep digital advertising profitable. There will be real humans on the internet.
Keep reading to learn how you can protect yourself, your money, and how you can join the fight.
PS: At the bottom of the text we added our exclusive discount for Voluum tracker and their Anti-Fraud solution.
What Are Bots Anyway?
Bots, or web robots, are programs designed to perform repetitive tasks on the internet. Some of them are innocent. Search engines, for example, use a special type of bots called crawlers to scan the contents of web pages. The other category consists of website performance monitoring bots.
Innocent bots can cause problems too. They can lower your site’s performance or artificially inflate page load numbers. Innocent bots, however, are easy to filter out—they openly introduce themselves as robots.
Malicious bots are a different breed. They are designed to make money for their creators in an illegal way. And make no mistake, the money made by bots is not created out of thin air—it may come from your pockets.
Where We Are Right Now
In 2022, the number of bots increased by 5.1% over the previous year. Of the total automated traffic observed, 30.2% constituted malicious bots, marking a 2.5% increase from the previous year’s figure of 27.7% in 2021.
Concurrently, there has been a surge in the prevalence of good bots, which coincides with the drop in human-generated traffic, declining from 57.7% in 2021 to 52.6% in 2022.
The total cost of ad fraud in 2022 was $81 billion, predicted to increase to $100 billion by 2023. The biggest hit was in the APAC region, with $75 billion in 2022.
That’s a lot of money. But how is it being made, and who’s getting it?
How Internet Bots Make Money
Bots can make money for their creators in a lot of ways. They can steal users’ accounts through account takeover attacks (ATO) or access protected data through targeted API attacks.
In the ad industry, there are several easy as well as more complex ways to make money in malicious ways.
Let’s start by classifying bots.
Types of Malicious Bots
Ad industry bots can be divided into the following categories:
| 1. Simple robots that perform single repetitive tasks, such as clicking links, loading pages, and so on. 2. Moderate bots that can launch scripts to perform more complex tasks. 3. Sophisticated bots that can mimic the behavior of real humans, such as mouse movements, and solve CAPTCHA. |
The two more complex bot types are often grouped together as “advanced robots” since they actively try to hide themselves from being detected, and the division between them is not clear.
The percentage of those advanced bots grows, while the percentage of simple bots stays the same. So the aforementioned growth in bot traffic can be fully attributed to advanced bots, which is worrying, as they are much harder to fight.
Ways Bots Generate Money
Bots use the specifics of the ad industry to make money for their creators. These are the following ways bots can commit ad fraud to generate income:
- Inflating page statistics, where bots visit the page to make it look more attractive in the eyes of an advertiser and raise the price.
- Ad stacking, where several ads are put on top of each other, so only the top one is visible, but all ads from the bundle get a registered view and pump up their statistics.
- Bundling, where IDs of several networks are bundled into one, falsely crediting multiple networks.
- Click injections, where a fraudulent app intercepts credits for installing another app.
- Bot farms & botnets, where human- or bot-operated networks of devices are used to inflate their customers’ conversion statistics. Such networks mimic the behavior of human users to a surprising degree.
Bot Traffic Trends in the Ad Industry
Bot traffic is a problem that will last as long as there are ads, but the nature of it is changing. Here are some of the most notable trends in malicious traffic in the ad industry.
1. Rise of the mobile
The ever-growing importance of mobile devices, which account for the majority of internet traffic, can be observed in the browsers that bots use to mimic. Typically, internet bots introduce themselves as popular desktop browsers, such as Chrome, Edge, Firefox, or Internet Explorer.
But recently, we have observed a trend where bots choose to pretend that they are the mobile versions of web browsers. Most notably, bots introduce themselves very often as Safari Mobile or Chrome Mobile.
2. AI used by all sides
The rise of generative AI means that scammers can create more bots with fewer required skills. After all, it is only a matter of a good prompt to create a simple clicking bot.
On the other hand, AI is very good at recognizing patterns, which, in the case of simple bots, are easy to spot. Advanced bots are harder to recognize, and there’s an ongoing battle between bots avoiding detection and bot prevention mechanisms (now backed with AI) that try to pinpoint them.
Overall, we think that AI may benefit the bot protection side more, as it can disrupt the profitability balance. Surely scammers can build an undetectable robot that can mimic human behavior so skillfully that it won’t be recognized even by AI bot monitoring tools, but it wouldn’t be cost-effective.
The point is not to trick AI but to earn more money on malicious activities than spending on them—and building such a sophisticated bot would be very costly.
3. API attacks
The most significant trend we can probably observe is the rise of automated API attacks. An API is a gateway that apps use to talk to each other.
The problem with APIs is that they are quite susceptible to attacks since they only need an authorization token to allow pulling or putting information.
Such a token is relatively easy to get, and since it is not parsed, it is ready to be used.
API attacks mean that platforms that are important cogs in the campaign funnel mechanism can be manipulated for malevolent purposes. With the rise of advanced bots, such attacks can be easily scaled up. Even unsuccessful attacks can make a platform sluggish or not work at all.
API attacks are a headache for platform owners, and there’s little advertisers can do to mitigate them apart from choosing reputable platforms.
How Does This Affect Marketers?
Bot traffic is dangerous because it makes efficient marketing impossible. It prevents marketers from making evidence-based and data-driven decisions by corrupting the visit and click numbers. Your ad dollars will not work for you.
If bots manage to fake conversion numbers, you will take the heat for sending low-quality traffic. The offer owner will eventually realize that some conversions are fake, and they will not pay you any money.
Money for installing apps will go to malicious apps that didn’t spend any money on advertising, and you will be stuck with a bill from an ad network and no payout from the app owner.
Finally, bots destroy trust, which is the fabric of a functional economy. If you don’t have trust, you won’t conduct business or you will at least increase margins to mitigate risk, which may make the whole operation not profitable. You will be forced to pay extra for bot protection tools, employ additional checks that add delay to page load time, and so on.
CAPTCHA tests are not only annoying; on a global scale, they take a lot of people's time.
How to Protect Yourself and Your Campaigns from Bots
Right off the bat: you can’t protect yourself fully. Just as you can’t protect yourself from getting a disease in your lifetime. At some point, you will catch something. And with good care, you will be able to mitigate the damages that the disease made in your body.
Unlike diseases, bots are a constant problem. There are almost no times when your campaigns are completely well and bot-free. There are spikes in bot traffic (and such unusual spikes are the best giveaway of bot traffic), but it’s best to assume that there are always some bots lurking to get your campaigns.
1. Use Trustworthy Ad Networks
The first thing is to make sure that you are getting traffic from reputable platforms that employ bot protection mechanisms on their own and do their best to sell you high-quality traffic of human origin.
You can’t go wrong with PropellerAds, which approaches traffic quality very seriously. As a multisource platform, PropellerAds uses the most advanced anti-ad fraud technologies and meticulously sifts all the traffic. Moreover, the platform has all the powerful performance marketing tools for quality lead generation. Discover CPA Goal, Smart CPC, and the latest addition – Subzone targeting.
No other point is probably as important as this one: what you buy is very often what you get. If you buy low-quality, you won’t get good conversion numbers.
2. Analyze Traffic for Patterns
Bot traffic very often follows certain patterns that you can observe in ad tracking software such as Voluum.
General patterns
- Unusual spikes and drops in traffic that can’t be easily pinned to how humans behave (for example, it is expected for traffic numbers to drop during nighttime).
- Traffic coming from countries that you don’t target. Traffic from outside the targeted GEO is usually a clear indication of potentially fraudulent activity. You can use an ad tracker to re-route this traffic outside your campaign funnel.
- Traffic coming from single IPs or IP ranges. Very often, bots come from one IP address but generate a lot of clicks. This is not how humans behave; they don’t click the same ad 50 times.
Advanced patterns can be observed if your tracking solution has more sophisticated tools that help to deal with bot traffic, like Voluum’s Anti-Fraud Kit. It allows you to check your traffic for various metrics that usually accompany non-human traffic.
Advanced patterns
Advanced patterns that Voluum will automatically recognize for you and mark as suspicious traffic:
- Fast and frequent clickers. Unusual numbers of clicks or unreasonably fast clicks are an indication of bot traffic.
- Traffic from data centers. Traffic coming from known data centers may indicate bot traffic but may also indicate users with active VPN services.
- Low time-to-install. Clicks that occur in a time that exceeds normal human reaction time can be attributed to bots.
- Deprecated OS. Clicks that come from ancient operating systems like Android 6 or Windows Mobile can be easily classified as bots.
3. Identify Bot-Infested Parts of Traffic and Block or Re-route Them
Bots often come from specific publishers or sites. You can use Voluum’s reporting to identify parts of traffic that have a high proportion of suspicious traffic and create a blacklist of publishers.
If such traffic comes from specific devices or OS types, you can stop purchasing traffic from these devices or use rule-based paths to redirect traffic outside your campaign funnel.
Use PropellerAds’ flexible targeting options to cut out parts of your traffic that you don’t want to appear in your campaigns.
When fighting bots, sometimes the best you can do is not stop bots from entering your funnel, but at least block them from reaching your offer. If an offer owner or an affiliate network realizes that you’re sending low-quality traffic, they may block you.
They have to protect the offer owner. You have to protect your reputation. If you can’t fight bots, at least direct them away from your offer.
Fighting Bots is Every Marketer’s and Platform Owner’s Responsibility
Unfortunately, you can’t just sit tight, do your thing, and wait for the problem to be solved by someone else. You have to do your part if you want to stay in business.
And your part is making sure that bots make as little money as possible. This is the only language bot operators understand – cost and profit ratio.
If you follow the rules outlined here, you are on a good path to making the Internet a better place for visitors and business owners. Keep fighting bots and stick with other platforms that do the same – like Voluum!
With our exclusive partner discount, you can get this great tracker for less.
