Managing and Mitigating Bots

Chapter 8. User-Generated Content (UGC) Abuse

Rather than attempting to capture data from your site, this class of automated traffic aims to use your website to publish content without your consent, via public areas of your site that allow user-generated content.

There is a separate class of bots that aims to inject content into your site that will exploit security weakness within your site (such as cross-site scripting or SQL injection). These are not discussed as they should be captured by good programming practice or other security devices such as web application firewalls (WAFs).

Good or Bad?

While the negative impact of content injection is not as severe as many of the other types of automated traffic, it is all negative. The objective of the areas that they are targeting is to capture and display content from users and that content should add value to the system as a whole. When bots automate injection of content they will be adding content with a different objective, at worst this can be promoting competitors or goods and services that you would not want associated with your brand or which may encourage users to leave your site.

While there are a number of different types of UGC abuse bots, they are all essentially carrying out the same activity but targeted at specific areas of a site. For example, a forum spammer will target posting to a forum and a comment spammer will target posting comments on an article or product—although, they have different objectives, they are ...