Imperva Bad Bot Report 2022 ↗ hard facts every advertiser who wants to protect their investments should know.
Have you ever wondered how much money you spend on clicks that will never lead to a sale? How many times has your advertising budget evaporated into thin air, and you blamed it on a «failed campaign» or «poor targeting»?
The numbers you are about to see will make you look at your advertising statistics in a completely different way. 27.7% of all global internet traffic in 2021 was bad bots. Almost every third visitor to your website, every third click on your ad — was not a human. It was software created to steal your money, steal your data, and destroy your advertising effectiveness. And this is only the beginning.
Digital reality in numbers
Data from Imperva's global network for 2021, based on hundreds of billions of blocked requests.
Human traffic: an endangered species
The Imperva Bad Bot Report 2022 is data from the real battlefield. In 2021, human traffic accounted for only 57.7%, falling by 2.5% compared to the previous year. Almost half of the internet is machines talking to machines, scanning, stealing, and committing fraud.
| Year | Humans | Good bots | Bad bots |
|---|---|---|---|
| 2014 | 40.9% | 36.3% | 22.8% |
| 2018 | 62.1% | 17.5% | 20.4% |
| 2019 | 62.8% | 13.1% | 24.1% |
| 2020 | 59.2% | 15.2% | 25.6% |
| 2021 | 57.7% | 14.6% | 27.7% |
* The trend is obvious: the share of bad bots is growing, while good bots (search engines) are declining. The internet is becoming more hostile.
Peak season: December 2021
In December, bad bots reached a record 30%. Holiday shopping always attracts fraudsters, and the Log4j vulnerability only added fuel to the fire. Every third visit to your site during that period was a program burning your budget.
Evolution of the invisible: why old methods are powerless
Blocking by a single IP is a thing of the past. In 2021, 65.6% of bad bots were «evasive». These are sophisticated systems that:
- Imitate mouse movements and clicks.
- Rotate IP addresses through proxies and P2P networks.
- Use «low and slow» tactics: a few requests per hour to avoid triggering protection.
- Masquerade as mobile browsers (35.6% of bad bots).
Bots are also moving from data centers (AWS share fell to 7.95%) to mobile carrier networks (27.2%). They are harder to distinguish from real users because they use the same IP pools.
Three main sources of business losses
Account Takeover (ATO)
Account theft grew by 148%. Attackers steal credit cards and bonuses, leading to a wave of chargebacks and reputational damage. The US is the target of 55% of ATO attacks.
Scraping
Competitors automatically collect your prices to undercut you and steal content, killing your SEO. Symptoms include falling conversion rates and unexplained site slowdowns.
Scalping
Bots instantly buy scarce products (consoles, graphics cards, tickets) for resale. You lose loyal customers who end up empty-handed.
Click fraud: how invisible bots burn your ad budget
Modern click fraud is invisible to standard analytics systems. A bot imitates human movements, clicks on an ad, spends the required time on the site, and leaves. Analytics counts it as a visit, and you pay for it.
Attacks by industry
- Sports57.1%
- Gaming and gambling53.9%
- Telecom and ISP46.9%
- Food and beverages44.6%
- Computers and IT35.7%
Geography of attacks
- USA43.1%
- Australia6.8%
- United Kingdom6.7%
- China5.2%
- Brazil3.3%
*In Germany and Ireland, more than 60% of traffic is bad bots.
Real cases: the scale of the disaster
- 400 million requests in 4 days: The largest low-and-slow attack on a job search website. About 400,000 unique IPs made just 10 requests per hour each.
- Visas for €400: Bots booked all visa appointment slots, leaving immigrants without legal options.
- Attacks on vaccination: A 77% increase during the COVID-19 booster rollout, creating an artificial shortage in healthcare.
Why traditional methods don't work
CAPTCHA, IP bans, and rate limiting are outdated. Evasive bots bypass CAPTCHA with AI and use millions of IPs. OWASP lists 21 types of automated threats.
You need the multi-layered click fraud protection that HaltClick provides.
- Behavioral analysis: we detect bots by movements, not just IP.
- Device Fingerprinting: real-time collection of device fingerprints.
- Click fraud blocking: filtering unwanted traffic.
The future of threats: time to act
Trends are not slowing down. In 2022, the share of evasive bots grew to 66.6%, and ATO attacks jumped by 155%. 51.2% of all scrapers are now classified as «advanced.»
27.7% of your traffic is bots. Protection is not an expense; it is an investment. Don't let bots steal your business.