In today’s digital landscape, bots dominate the internet, with some estimates suggesting they account for over 50% of all website and mobile API activity. Beneficial bots support search engines, fulfill genuine business needs, and automate repetitive tasks. While some are outright malicious and enable fraud, many other bots operate somewhere in the middle—in the murky grey area between illegal and immoral. They ignore website terms of use, prevent customers from purchasing goods and services, and can even weaken security. Existing research often examines uncontrolled bot traffic across the entire internet, but this report takes a different approach and, instead, focuses on how automated traffic changes after bot mitigation is put in place.

We provide a detailed analysis of bot types, their objectives, and industry-specific impacts. A key focus is on advanced and persistent bots—those that adapt as security measures evolve. Malicious actors, including nation-states and cybercriminals, frequently modify tactics to bypass defenses, increasing attack sophistication or moving to softer targets. This report analyzes over 200 billion web and API transactions from F5’s Bot Defense customers from November 2023 to September 2024.

03/28/2025 report 40 min. read

Companion content for the 2025 Advanced Persistent Bots Report

2025 Advanced Persistent Bot Report: Scraper Bots Deep-Dive
2025 APB Report
Bots and Automated Attacks
2025 Advanced Persistent Bot Report: Scraper Bots Deep-Dive
How much do scraper bots affect your industry?
03/28/2025 article 5 min. read
From Bots to Boardroom: How Bad Bots Negatively Impact Your Balance Sheet
F5 White Paper
From Bots to Boardroom: How Bad Bots Negatively Impact Your Balance Sheet

Learn how to communicate the costs of automated, malicious bot attacks on your organization and the business benefits of successful bot management.

Prevent Web Scraping by Applying the Pyramid of Pain
2025 APB Report
Bots and Automated Attacks
Prevent Web Scraping by Applying the Pyramid of Pain
The Bots Pyramid of Pain: a framework for effective bot defense.
03/28/2025 article 4 min. read
2024 Bad Bots Review
2025 APB Report
Bots and Automated Attacks
2024 Bad Bots Review
Learn the latest trends in bots and malicious automation so you can compare with attacks against your own organizations.
03/14/2024 article 15 min. read

What Are Bots?

Bots are simple programs that carry out repetitive tasks on the Internet on behalf of humans. Bots aren’t inherently bad and can be either malicious or benign. Benign bots provide basic but useful services, such as passively crawling the Web to index content on the web for search engines, or chatting with website visitors to help them find resources they need. Malicious bots, on the other hand, are scripts or programs designed to automate the actions an attacker would take in a cyberattack, allowing attackers to hit their targets faster and harder than they would if they were attacking manually.

Malicious bots have therefore become a core tool for attackers because they act as a force multiplier for attacks. This is key to why attackers use bots in so many different ways—bots are a way for attackers to achieve scalability no matter what their goals and techniques are. A group of bots that are all employed by a single threat actor or for a single purpose is often referred to at a botnet.

How Do Threat Actors Use Bots for Cyberattacks?

Threat actors use bots for a wide range of cyberattacks—in short, anything where simple, repeatable actions on the Internet can be repeated. Perhaps the most well-known kind of bot-supported attack is a distributed denial of service (DDoS) attack, but bots are also critical for credential stuffing, brute force, and click fraud. Because of the speed at which they can operate, they are also crucial tools for resellers, who use appropriately-named reseller bots (sometimes known as sneaker bots) to purchase high-demand commodities for resale.

Because of the wide range of nefarious uses for bots, it is important to think of them as a generalized tool and not a specific kind of attack. A ‘bot’ can be nothing more than a series of cURL requests, or it can be a sophisticated and modular piece of software that costs threat actors thousands of dollars. The defining characteristic is the use of automation for fast, repetitive, malicious actions on the Web. F5 Labs often refers to these kinds of attacks as ‘automated attacks’ to reflect the diversity of motivations and impacts associated with these methods.

How Can You Stop Malicious Bots and Automated Attacks?

Because malicious bots are designed to imitate how humans act, the first step in bot mitigation is bot identification. Once a request is identified as having come from a bot, the responding server can drop the connection and/or add that bot to a denylist.

One of the first and most well-known bot identification strategies was CAPTCHA. While CAPTCHA was initially successful, it places the burden of differentiation on customers and users even when it succeeds. Furthermore, over time threat actors have found reliable methods for bypassing CAPTCHA, so even if this degree of user friction is acceptable, it is no longer effective.

As attackers adapt to older bot mitigation strategies, organizations are increasingly turning to tools that detect bot traffic based on a combination of behavioral and technical signals. In contrast to CAPTCHA, this has the advantage of working undetected for legitimate human users. While simple bots can be easily detected by monitoring a few HTTP parameters, sophisticated bots go to great lengths to simulate complete browsers and human activity. Accurately mitigating these advanced bots requires machine learning platforms and the analysis of a wide range of signals.

Ready to Learn More?

Bots and automated attacks are a particular area of focus for us, and we're always looking for better ways to understand the threats they pose to security environments and how to defend against them. Sometimes that means looking at especially topical data, sometimes it means drilling down into a particular facet of the problem space, and sometimes it means taking a broad view to look at trends. Asking questions of the data leads to insights and, inevitably, more questions, so there's always more research to do. Below, you can see some of our more specific investigations grouped together to satisfy the instinct to pull on one particular thread, and you'll also find a collection of all our research into bots and automated attacks.

All Bots & Automated Attacks Research

2025 Advanced Persistent Bots Report
Bots and Automated Attacks
2025 Advanced Persistent Bots Report
03/28/2025 report 40 min. read
2025 Advanced Persistent Bot Report: Scraper Bots Deep-Dive
Bots and Automated Attacks
2025 Advanced Persistent Bot Report: Scraper Bots Deep-Dive
03/28/2025 article 5 min. read
Prevent Web Scraping by Applying the Pyramid of Pain
Bots and Automated Attacks
Prevent Web Scraping by Applying the Pyramid of Pain
03/28/2025 article 4 min. read
Black Friday Versus The Bots
Bots and Automated Attacks
Black Friday Versus The Bots
11/21/2024 article 11 min. read
How to Identify and Stop Scrapers
Bots and Automated Attacks
How to Identify and Stop Scrapers
09/05/2024 article 26 min. read
What Are Scrapers and Why Should You Care?
Bots and Automated Attacks
What Are Scrapers and Why Should You Care?
08/02/2024 article 14 min. read
2024 Bad Bots Review
Bots and Automated Attacks
2024 Bad Bots Review
03/14/2024 article 15 min. read
H1 2023 Bad Bots Review
Bots and Automated Attacks
H1 2023 Bad Bots Review
02/07/2024 article 15 min. read
Bots Cheat to Win
Bots and Automated Attacks
Bots Cheat to Win
02/05/2024 article 17 min. read
Fake Account Creation Bots – Part 4
Bots and Automated Attacks
Fake Account Creation Bots – Part 4
12/08/2023 article 14 min. read
Bots Target Retailers for Black Friday Bargains
Bots and Automated Attacks
Bots Target Retailers for Black Friday Bargains
11/17/2023 article 19 min. read
Fake Account Creation Bots – Part 3
Bots and Automated Attacks
Fake Account Creation Bots – Part 3
11/07/2023 article 15 min. read
2023 Identity Threat Report: Executive Summary
Bots and Automated Attacks
2023 Identity Threat Report: Executive Summary
11/01/2023 article 5 min. read
2023 Identity Threat Report: The Unpatchables
Bots and Automated Attacks
2023 Identity Threat Report: The Unpatchables
11/01/2023 report 80 min. read
Fake Account Creation Bots – Part 2
Bots and Automated Attacks
Fake Account Creation Bots – Part 2
10/12/2023 article 14 min. read
Fake Account Creation Bots – Part 1
Bots and Automated Attacks
Fake Account Creation Bots – Part 1
09/08/2023 article 16 min. read
How a Sneaker Bot Earned $2M Profit from One Shoe Drop
Bots and Automated Attacks
How a Sneaker Bot Earned $2M Profit from One Shoe Drop
06/06/2023 article 13 min. read
How Bots Ruined the PS5 Launch for Millions of Gamers
Bots and Automated Attacks
How Bots Ruined the PS5 Launch for Millions of Gamers
03/18/2023 article 11 min. read
Reseller Bots: Understanding the Ecosystem
Bots and Automated Attacks
Reseller Bots: Understanding the Ecosystem
01/12/2023 article 11 min. read
Reseller Bots: Defining the Problem
Bots and Automated Attacks
Reseller Bots: Defining the Problem
12/16/2022 article 13 min. read
I Was a Human CAPTCHA Solver
Bots and Automated Attacks
I Was a Human CAPTCHA Solver
05/13/2021 article 10 min. read
Email Compromise with Credential Stuffing Attack Tools
Bots and Automated Attacks
Email Compromise with Credential Stuffing Attack Tools
04/21/2021 article 5 min. read
2021 Credential Stuffing Report
Bots and Automated Attacks
2021 Credential Stuffing Report
02/09/2021 report 45 min. read
Can Bots Manipulate Data and Change Facts to Fiction?
Bots and Automated Attacks
Can Bots Manipulate Data and Change Facts to Fiction?
01/13/2021 article 5 min. read
How Credential Stuffing Bots Bypass Defenses
Bots and Automated Attacks
How Credential Stuffing Bots Bypass Defenses
08/26/2020 article 11 min. read
Turing in His Grave: What Human CAPTCHA Solvers Reveal About Control Design
Bots and Automated Attacks
Turing in His Grave: What Human CAPTCHA Solvers Reveal About Control Design
05/28/2020 blog 13 min. read
Good Bots, Bad Bots, and What You Can Do About Both
Bots and Automated Attacks
Good Bots, Bad Bots, and What You Can Do About Both
03/01/2019 article 12 min. read