Bot Detection: How to Detect Bot Traffic and Stop Automated Fraud

Introduction

Bots are not a side problem anymore. They sign up for free trials, test stolen cards, stuff leaked passwords into login forms, and scrape your prices. Most of them never look like an attack. They look like busy traffic.

That is what makes automated fraud expensive. A bot that creates fake accounts or tests cards can run thousands of times before anyone notices the pattern. By then, the chargebacks, wasted promo credits, and cleanup work have already landed.

Imperva's 2025 Bad Bot Report found that automated traffic made up 51% of all web traffic in 2024, surpassing human activity for the first time in a decade, and that bad bots alone accounted for 37% of all internet traffic, up from 32% in 2023. Source: Imperva, 2025 Bad Bot Report

This guide explains how bot detection works, which signals catch bad bots without blocking real customers, and how to add bot checks to signup, login, and checkout. Greip supplies the IP, network, and identity risk signals. Your rules decide what happens next.

What Bot Traffic and Automated Fraud Look Like Today

Bot traffic is any request sent by software rather than a person typing and clicking. Some of it is useful. Search engine crawlers, uptime monitors, and partner API integrations are all bots.

Automated fraud is the harmful part. It happens when bots exploit a business process at scale. Common targets include:

• Signup forms, where bots create fake accounts for promo abuse or spam
• Login pages, where bots try leaked credentials in bulk
• Checkout and payment forms, where bots test stolen card numbers
• Product and pricing pages, where scrapers copy content and data
• Limited inventory drops, where scalper bots buy stock before real customers can

The common thread is volume and speed. A single fraudster can only do so much by hand. A bot does the same action thousands of times, from many IP addresses, with small changes each time.

Good Bots vs Bad Bots: Why Blocking All Automation Backfires

The goal of bot management is not to block every bot. It is to separate good bots from bad bots and treat each one correctly.

Good bots identify themselves and follow your rules. Search engines crawl your pages so customers can find you. Monitoring tools check that your site is up. Your own integrations call your API on schedule.

Bad bots hide what they are. They rotate IP addresses, fake browser details, and imitate human timing. Blocking all automated traffic would hurt your search visibility and break legitimate integrations. Letting all of it through invites fraud.

The Bot Attacks That Cost Businesses the Most

Not every bot attack carries the same cost. These are the ones that hit revenue and trust hardest.

Fake Account Creation

Bots register accounts in bulk to claim signup bonuses, abuse free trials, post spam, or build networks of accounts for later fraud. Each fake account adds cost to your funnel and noise to your data. Greip covers this pattern on its fake accounts use case page.

Credential Stuffing and Account Takeover

Attackers feed leaked username and password pairs into your login page. When a pair works, the bot takes over a real customer's account. We cover the detection side in our guide to credential stuffing attacks.

Card Testing

Fraudsters use bots to run small payments with stolen card numbers. The goal is to find which cards still work before using them for larger purchases. Merchants pay for the declines, the disputes, and sometimes higher processing fees.

Scraping and Scalping

Scraper bots copy pricing, content, and inventory data. Scalper bots buy limited stock the moment it goes live. Both distort your metrics and frustrate real customers.

Why CAPTCHAs and User-Agent Checks Alone Fall Short

Many teams start with a CAPTCHA and a list of blocked user agents. Both still have a place. Neither is enough on its own.

CAPTCHAs add friction for every visitor, including your best customers. Modern bots can also solve many challenges, either with AI tools or by paying human solving services.

User-agent strings are easy to fake. A bot can claim to be the latest version of Chrome on a Mac in one line of code. Imperva's infographic on the same report notes that 46% of bot attacks used Chrome impersonation and 21% used residential proxies. Source: Imperva, Bot Traffic at a Tipping Point

That is why stronger bot detection combines several signals. A bot can fake one detail easily. Faking a clean IP, a consistent network, a real email, a working phone number, and normal behavior all at once is much harder.

How Bot Detection Works: The Signals That Matter

Bot detection is a scoring problem. Each request or event gets checked against signals that separate automated traffic from real people. The main signal groups are:

1. IP and network signals. Is the IP a VPN, proxy, Tor exit node, or hosting provider? Is it on a threat list? Does its ASN belong to a cloud network?
2. User-agent and device signals. Does the user agent match known automated patterns? Does the device data look consistent?
3. Identity signals. Is the email disposable or newly created? Is the phone number valid and in service, or a disposable number?
4. Behavior and velocity signals. How many signups, logins, or payments came from this IP, device, or card in the last hour? How fast was the form filled in?
5. Transaction signals. Does the card country match the IP country and billing address? Is the amount unusual for this account?

No single signal proves a bot. A hosting IP might be a developer testing your API. A VPN user might simply care about privacy. The value comes from combining signals and acting on the overall risk.

Using IP and Network Intelligence to Detect Bots

Most bad bots run from infrastructure that real shoppers rarely use. Data center servers, open proxies, and anonymization networks give attackers cheap, disposable IP addresses. That makes IP and network intelligence one of the fastest ways to flag automated traffic.

Checking the Security Module on an IP

Greip's IP Lookup endpoint returns a security object when you pass params=security. You send the visitor's IP from your backend, with your API key in the Authorization header.

curl --request GET \
  --url 'https://v2.greipapi.com/lookup/ip/165.227.149.217?params=security' \
  --header 'Authorization: Bearer <token>'

The security object in the documented sample response looks like this:

"security": {
  "vpn_or_proxy": true,
  "vpn_or_proxy_type": "VPN",
  "tor": false,
  "bot": false,
  "relay": false,
  "relay_country": null,
  "relay_city": null,
  "hosting": true,
  "is_blacklisted": false
}

Each field answers a simple question. vpn_or_proxy and vpn_or_proxy_type show anonymization. tor flags Tor exit nodes. hosting shows the IP belongs to a hosting or cloud provider. is_blacklisted shows whether the IP is on a threat list. bot indicates whether the request looks automated. The response also includes an asn object with a type value, such as hosting, which helps you spot traffic coming from cloud networks.

Getting a Single IP Risk Score

If you want one number instead of separate flags, Greip's IP Scoring endpoint at GET /score/ip/{ip} returns a composite score from 0 to 100, a risk_level of low, medium, or high, and a recommendation of accept, review, or reject. Here is the documented sample:

{
  "success": true,
  "data": {
    "ip": "12.12.12.12",
    "score": 35,
    "risk_level": "medium",
    "recommendation": "review",
    "rules": [
      {
        "id": "IP_VPN_OR_PROXY",
        "description": "IP address is associated with VPN, proxy, or anonymization service."
      },
      {
        "id": "IP_HOSTING",
        "description": "IP address belongs to hosting or cloud provider ASN."
      }
    ]
  }
}

The rules array lists only the signals that fired. For bot detection, the IP_BOT rule is the one to watch. The docs describe it as a request user-agent matching automated bot patterns. IP_HOSTING, IP_VPN_OR_PROXY, IP_TOR, and IP_BLACKLISTED add context about the network behind the request.

These signals are part of Greip's VPN and proxy detection service, which covers VPN, proxy, Tor, hosting, relay, and bot signals plus an IP reputation score.

How to Add Bot Detection to Signup, Login and Checkout

The best place for bot checks is at the moments that matter, not on every page view. Here is a practical way to roll it out.

Step 1: Score Signups Before Creating the Account

When a user submits your signup form, check the IP first. Then score the email and phone number with Greip's email and phone scoring to catch disposable addresses and numbers that bots use in bulk. If the IP is a hosting address and the email is disposable, hold the account for verification instead of activating it.

Step 2: Protect Login With Risk-Based Challenges

At login, combine the IP risk score with velocity. Many failed logins from one IP, or one account targeted from many hosting IPs, points to credential stuffing. Use the score to decide when to step up authentication instead of forcing every user through MFA.

Step 3: Screen Payments for Card Testing

At checkout, look for many small payment attempts, repeated declines, and mismatches between the card country and the IP country. Greip's payment fraud analysis combines IP, card, and transaction context into a fraud score you can act on.

Step 4: Map Scores to Clear Actions

Keep your policy simple at first:

• Accept low-risk events with no extra friction
• Review or challenge medium-risk events with email verification, a one-time code, or a CAPTCHA
• Block high-risk events, especially when several strong signals fire together

Log every decision with the signals that drove it. That record helps you tune thresholds later and explain decisions to your support team.

Real-World Bot Fraud Scenarios

Seeing the signals in context makes the rules easier to design.

A SaaS Free Trial Under Attack

A SaaS company sees hundreds of new trials in one night. Most come from hosting IPs in the same ASN, use disposable emails, and never log in again. A signup rule that holds accounts when hosting is true and the email scores as disposable stops the wave without touching real customers on home or mobile networks.

Card Testing on an Online Store

An online store notices dozens of $1 payment attempts, each with a different card, all from proxy IPs. A checkout rule that challenges payments when the IP is a proxy and the attempt count per IP is high cuts off the test before the fraudster finds working cards.

Credential Stuffing on a Marketplace

A marketplace gets a spike in failed logins across many accounts. The IPs rotate, but most belong to hosting providers or appear on threat lists. Adding a step-up challenge when the IP score is medium or high blocks the bot while real users log in normally.

Common Bot Detection Challenges and How to Handle Them

Bot detection is never perfect. Plan for these issues from day one.

False Positives on Privacy-Conscious Users

Some real customers use VPNs or privacy relays. Blocking them outright costs you sales. Treat a VPN flag as a reason to look closer or add light friction, not as an automatic block.

Residential Proxies

Advanced bots route through residential IPs that look like normal home connections. Here, identity and velocity signals matter more. A residential IP with a disposable email and ten signups in five minutes is still suspicious.

Shared and Mobile IPs

Mobile carriers and offices often put many users behind one IP. Rate limits that work on a single home connection can block a whole office. Combine IP velocity with account and device signals before you block.

Attackers Who Adapt

When you block one pattern, bots change tactics. Review your rules regularly and watch for new spikes in signups, declines, or failed logins.

Bot Protection Best Practices

These habits keep bot protection effective without hurting conversion.

• Layer your defenses. Use network signals, identity checks, velocity limits, and behavior together.
• Score at key events. Focus on signup, login, password reset, checkout, and promo redemption.
• Rate limit sensitive endpoints. Cap requests per IP, account, and card over short time windows.
• Use honeypot fields. Hidden form fields that only bots fill in are a cheap, low-friction signal.
• Allowlist trusted automation. Keep your own services and partners out of bot rules.
• Challenge before you block. Step-up checks recover real customers who trip a rule.
• Monitor and tune. Track false positives and adjust thresholds as your traffic changes.

Bot Management Trends to Watch

Bot attacks keep getting cheaper to run. Imperva's 2025 report links much of the growth to accessible AI tools that make bot creation easier and more scalable.

That has a few practical effects. Simple, high-volume bot attacks are rising because they cost so little to launch. Bots that mimic human behavior are harder to catch with timing or mouse-movement checks alone. APIs are also a growing target, since they often skip the browser checks that protect web forms.

The response is the same principle this guide follows: combine independent signals. A bot can fake a browser. It is much harder to fake a clean network, a real identity, and normal velocity at the same time.

Frequently Asked Questions

What is bot detection?

Bot detection is the process of identifying requests and actions made by automated software instead of real people. It uses signals such as IP and network data, user-agent patterns, identity checks, and request velocity to score the risk of each event.

What is automated fraud?

Automated fraud is fraud carried out at scale by bots or scripts. Common examples are fake account creation, credential stuffing, card testing, scraping, and scalping.

How do you detect bot traffic on a website?

Combine several signals. Check whether the IP is a VPN, proxy, Tor exit node, or hosting provider, look for user agents that match automated patterns, score emails and phone numbers, and watch for unusual velocity on signups, logins, and payments.

What is the difference between good bots and bad bots?

Good bots, such as search engine crawlers and monitoring tools, identify themselves and follow your rules. Bad bots hide their identity and abuse your site through fake signups, login attacks, card testing, or scraping.

Are CAPTCHAs enough to stop bots?

No. CAPTCHAs add friction for real users, and many modern bots can solve them. Use CAPTCHAs as one challenge option within a layered approach that also uses IP, identity, and velocity signals.

How does Greip help with bot detection?

Greip provides risk signals rather than a full bot management platform. Its IP Lookup and IP Scoring endpoints return VPN, proxy, Tor, hosting, blacklist, and bot flags, plus a composite IP risk score, and its email and phone scoring help catch disposable identities used by bots.

Conclusion

Bots now make up a large share of web traffic, and the bad ones target the moments where your business makes or loses money: signup, login, and checkout. Blocking them one user agent at a time does not scale.

Effective bot detection layers several signals. IP and network intelligence flags the infrastructure bots rely on. Identity checks catch disposable emails and phone numbers. Velocity rules expose the speed and volume that give automation away.

Start with your highest-risk event, score it with the signals above, and map the score to accept, challenge, or block. Then review and tune as attackers adapt. Greip gives you the risk signals through one API key, so your team can focus on the rules that protect your customers.