Fake Googlebots attacking websites daily

Millions of fake search bots are making their way into websites on a daily basis with the intent of hacking, committing DDoS attacks and content theft, delivering spam, and undertaking other cyber criminal activities, says US security vendor Incapsula.

The firm conducted a study over 30 days in which it observed 400 million visits on 10,000 websites from search engines, and discovered that over four per cent of the bots were fake.

After an analysis of the bots, it was found that around a third clearly had malicious intent. That is consistent with the websites involved in the study experiencing over 1.3m malicious visits every day from search engines.

The firm said that the bots have a multitude of purposes. Approximately two-thirds seek market intelligence and around one quarter are undertaking Layer 7 DDos attacks. About 1.7 per cent are used for hacking and 3.8 per cent for spamming, while 5.3 per cent are scraping.

Igal Zeifman, Incapsula’s product evangelist, wrote:

“Just consider the benefits that come with fake Google credentials. For one, ‘Google ID’ is as close as a bot can get to having a VIP backstage pass for every show in town.

“After all, most website operators know that to block Googlebots is to disappear from Google.”

Zeifman said that website operators using rate-limiting solutions as protection – as opposed to inspecting traffic one case at a time – are not able to differentiate between real and fake Googlebots.

SMEs require the best software and methods they can feasibly afford in order to offer their systems adequate protection. That also means posting cyber security jobs to ensure that they have the staff in place capable of operating such systems.