As More People Return to Travel Sites, So Do Malicious Bots

With summer holidays, long weekends, and relaxed restrictions on staying at home, the suffering travel industry is seeing some reemerging signs of life: organic visits to car rental websites have grown by 285% since April 1 after a significant drop in traffic during the COVID-19 shutdown.

But as organic growth returns, so have bots carrying out a variety of attacks, including content and price-scraping, hoarding, and malicious attempts to take over user accounts, aka account takeover (ATO), according to a new report from PerimeterX.

"This increase in users is accompanied by an increase in competitive scraping bot requests," PerimeterX Founder and CTO Ido Safruti said in a blog post, referring to the practice where competitors use bots to grab inventory and pricing information from an ecommerce website.

The data shows that competitive scraping-bot requests almost doubled the week of April 20, spiking the last week of April by 544% — and remaining at that level ever since — with a "dramatic increase" in malicious requests from Asia and Europe.

Car rental sites aren't alone, according to PerimeterX. While lodging websites are only seeing 60% of the organic traffic they saw in early March, malicious activity has remained consistent on those sites throughout the pandemic.

"Malicious traffic on this industry did not slow down during this entire period, and we've seen a steady level of scrapers and account takeover (ATO) attacks hitting these sites," writes Safruti.

And while the airline industry is witnessing only a small recovery compared to rental cars, malicious attacks increased 151% by May, and those sites have remained at that level. The malicious bot attacks on airline websites are still not as high as they were before the pandemic, however.

PerimeterX's Safruti says there's reason to believe some of this activity is driven by a coordinated effort. "Large advanced ATO campaigns are in many cases coordinated among crime organizations/actors, and we see large campaigns operating across multiple sites," he said in an email interview. 

Plus, some of the activity isn't criminal, but is likely "competitive warfare."

"Scraping a site's content or pricing is legal (though may break the terms of use of the site). That means there is a market for scrapers, and companies providing data-scraping services and tools for that, and they are selling it out there," he said.

For site operators looking to get a handle on the issue, Safruti recommends checking their logs for anomalies and increased login/failed login attempts, particularly those that don't result in a completed booking.

"Most site operators are aware of the general issue of bots, but not necessarily to the extent that they're impacting their site," he said.

Related Content