1

We have recently discovered that a third party has been using a bot to manipulate traffic on one of our websites. We have gathered enough information to determine that the traffic is indeed a bot, and not a real human.

We have our suspicions about who is behind the attack, but don't have any hard evidence. So my questions is, what are some things that can be done to determine who (the real life person or company) is behind the attack?

The information we have gathered so far are:

  • The IP of the bot.
  • User-agent string of the bot including the browser used
  • The non-sensical browsing pattern of how the bot crawls our site.

Edit: Per the comments below I am not allowed to request that answers do not include anything illegal. Understandable as this is not a site for legal advice, nor could anyone be expected to know all the legal ins and outs of this situation. I'll open it up to all answers, but if you suggest torture or extortion your answer will be ignored :P

closed as primarily opinion-based by Steve, Xander, Trey Blalock, Mike Ounsworth, Serge Ballesta Apr 1 '17 at 8:53

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • As it stands, the range of possible answers is too broad. There are a lot of things the could be done, but it is impossible to narrow them down with the little we have to work with. As someone who runs honeypots, UBA, and other investigations, attribution is not easy, and not always possible to predict how attribution could be made. Usually, the person tips their hand via a mistake. – schroeder Mar 30 '17 at 16:04
  • Just assume it was the russians! and by russians I mean the CIA. Beyond banning the bot there isn't really much you can do, maybe some shadow ban type of punishment if you have been paying money for traffic, but even that may get you in trouble legally if its not in your terms of service. – daniel Mar 30 '17 at 16:12
  • @schroeder If there is more information I could gather and/or provide, please let me know. I am happy to provide what I can. – Canoe Mar 30 '17 at 16:20
  • 1
    Frankly, I'd contact the owner of the IP (ISP, company, w/e) and see what help they can be in tracking down the actor – schroeder Mar 30 '17 at 17:26

Browse other questions tagged or ask your own question.