# What is a bad bot?

Source: https://kavralab.com/glossary/bad-bot/

A **bad bot** is automated software that disguises itself as a real visitor or a trusted crawler to abuse a website or app, for example by testing stolen passwords, copying prices, creating fake accounts or buying limited stock. Kavra catches bad bots by the contradictions their disguises leave across network, device, browser and behavior.

## What makes a bot bad

A bad bot has two traits: it hides what it is, and it takes something the site did not mean to give it. It may claim to be Chrome on a laptop while running on a server, borrow the name of a search crawler, or rotate through thousands of home IP addresses so rate limits never trigger. The goal is always to act at a scale no single person could, while looking like many ordinary people.

Operators rent these bots as a service or buy ready-made kits for a specific site, complete with proxy lists, spoofed device profiles and CAPTCHA-solving add-ons. That lowers the skill needed to attack a login or a promotion to almost nothing, which is why a campaign can start the same day a new offer goes live.

## Types of bad bots and what they target

| Bad bot | Where it strikes | What you lose |
|---|---|---|
| [Credential stuffing](https://kavralab.com/glossary/credential-stuffing/) bot | Login | Customer accounts, support time, trust |
| [Web scraping](https://kavralab.com/glossary/web-scraping/) bot | Product, price and search pages | Pricing edge, content, server capacity |
| Fake account bot | Signup | Bonus and trial budgets, clean data |
| Scalping bot | Cart and checkout | Limited stock sold to resellers |
| Card testing bot | Payment form | Fees, chargebacks, processor standing |
| SMS pumping bot | OTP and phone verification | Messaging bill |
| Impostor crawler or agent | Anywhere a good bot is allowed | Access meant only for verified bots |

## How bad bots show up in real traffic

Sophisticated bad bots rarely look like a flood from one address. They look like a slightly busier day: signups that are a little too regular, logins from many cities that fail at the same rate, product pages read in perfect order, carts filled seconds after a drop. The damage appears later as account takeover complaints, bonus costs that do not match growth, or competitors matching your prices within minutes.

- Traffic from residential or mobile proxy networks rather than data centers.
- Browsers that claim one device but behave like another, often a [headless browser](https://kavralab.com/glossary/headless-browser/).
- A new device fingerprint on every visit from what is really one actor.
- Input that is too fast, too even or missing altogether.
- Declared crawlers or AI agents arriving from outside their operator's IP ranges.

## How to stop bad bots

CAPTCHAs and IP blocklists each check one thing, and bad bots are built to pass exactly that thing. Stopping them takes evidence from several layers compared at once, and a decision at the endpoints that matter. Kavra analyzes 3,000+ data points per visit, looks for contradictions between layers, and tells your backend whether to allow, verify or block, without puzzles for real customers. Start with [headless browser detection](https://kavralab.com/detect/headless-browsers/) or see how it stops [web scraping](https://kavralab.com/solutions/web-scraping/). For the other side of the line, read what makes a [good bot](https://kavralab.com/glossary/good-bot/).

## FAQ

### What are the signs of bad bot traffic on my site?

Look for login failure spikes, bursts of signups around promotions, high traffic to price or search pages with no purchases, carts emptied of limited stock within seconds, and OTP requests to unusual countries. Each can have an innocent cause, so compare them with device, network and behavior evidence before acting.

### Do bad bots only target large companies?

No. Bots are cheap to run and aim at whatever pays: a small shop's discount code, a new sportsbook's welcome bonus or a startup's free API credits. Smaller sites are often hit harder because they have fewer defenses and a single campaign can wipe out a month's marketing budget.

### Can a web application firewall stop bad bots?

A firewall is good at blocking known attack patterns and obvious floods, but most bad bots send perfectly valid requests: a normal login, a normal page view, a normal checkout. Telling them apart needs evidence about who is making the request, which is what dedicated bot detection adds on top.

---
Kavra Lab: bot and fraud detection that explains every decision. Book a demo: https://kavralab.com/contact/