Rather than resulting from end-of-the-year sales attempts, a targeted junk assault that flooded the organization with fraudulent enrollment forms, the majority of which seemed reputable enough not be lost on sight caused this spike.

So when the tiny background check team started to fall below the deluge of on-line forms that were apparently valid, all on-line sales businesses were brought to a halt. After a fast assessment of the website traffic of the firm, it rapidly became clear that what the customer was really experiencing was malicious bot action.

In this instance, the bot operator understood enough about the organization to recognize the guide background check procedure as a “soft spot,” which may be utilized to monkeywrench the firm’s entire sales funnel.

To use that weak spot, the perpetrator handcrafted a spam bot whose only intention was to assault that one special enrollment form with details that would not meet any design that is readily identifiable. Most concerning, these bots were disguising themselves as frequent users that are individual, with browser- like HTTP fingerprints and lots of abilities that enabled them to circumvent the challenge of the site -based, access control mechanism.

This really isn’t the very first time we have encounter such advanced bots which are purpose built to mimic human behavior and work under the cover of a browser-like identity. Created for stealth and favored for their capability to avoid security measures that were trivial, such automated tools are used by hackers not only for spam attacks, but in addition to steal information, hijack servers and run DDoS attacks, among other nefarious tasks.