Website Protection Against Bots: Six Years of Traffic Filtering Evolution from Behavioral Bots to Multi-Layer Analytics
The author first encountered the issue of web traffic quality in 2020 while working on web development and SEO. Normal traffic patterns in analytics were replaced by storms of anomalous visits that showed identical behavior impossible for real users. Detailed inspection of Yandex Metrika Webvisor reports confirmed these were not genuine visitors but automated scripts aimed at manipulating behavioral factors.
Initial experiments relied on Cloudflare custom rules because no other tool offered comparable technical flexibility. The first published article on the topic documented cases of social-network bot traffic and its negative SEO impact. Research across multiple client projects consistently linked the appearance of this traffic with organic position drops and pessimization.
Between 2020 and 2021 the first wave manifested as 30–60 daily visits from social platforms where the site had no real presence. Blocking referrers via .htaccess simply caused bots to switch to direct entries or endless external domains. Server-side JavaScript and cookie validation forced bots to change their reported source but did not halt the traffic.
Two mobile IP ranges belonging to MegaFon were temporarily blocked with short-term success, yet the bots immediately migrated to new pools. The same pattern repeated with IPv6 traffic, proving that static IP blacklists become a losing race against rotating proxies.
Digital fingerprints proved equally unreliable. Each bot visit presented a fresh browser profile, rendering fingerprint-based detection ineffective. The author coined the term “behavioral bots” to distinguish this class of automation from classic crawlers because the scripts actively imitated human navigation and actions.
Excluding suspicious IPs from Yandex Metrika reports created an illusion of clean statistics while the actual requests continued to hit the origin server. The author repeatedly warned that visual cleanup of analytics does not equal protection and that genuine filtering must occur before requests reach the application.
Related articles
Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have detailed Drama RAT, a sophisticated Android banking trojan distributed via phishing messages in messengers and disguised as VPN services or banking apps. The malware uses droppers that request installation of fake updates, then deliver a full-featured payload capable of stealing credentials, recording screens, and performing overlay attacks. Drama RAT automatically grants itself Accessibility permissions while hiding the process behind opaque overlays and employs multiple persistence mechanisms including AlarmManager alarms and Doze mode bypass. Communication occurs primarily over mTLS WebSocket with a fallback CDN channel, while anti-analysis features include over 1200 junk artifacts, broken AndroidManifest.xml, Frida hooking detection, and per-class string obfuscation. The trojan supports keylogging, SMS interception, VNC screen sharing, microphone and camera recording without indicators, and participation in DDoS attacks. Positive Technologies notes that removal is extremely difficult without ADB or safe mode because the malware redirects users away from settings screens.
Attackers Abuse Legitimate Node.js Runtime to Deploy Persistent Malware in Targeted Operations
Cybercriminals are increasingly misusing the legitimate Node.js runtime to execute malicious JavaScript scripts and maintain persistence on corporate networks. The technique has been observed since February 2026 against governments, technology firms, hotels, and financial organizations. Attackers favor the signed node.exe binary to evade signature-based detections after initial access via ClickFix social engineering. In one case against an Asian technology company, Node.js was deployed following blocked attempts to install AdaptixC2 and Cobalt Strike. The resulting implant establishes registry persistence and communicates with Ethereum blockchain gateways to retrieve commands hidden in smart contracts. The approach has been linked to multiple tools including ModeloRAT, Mistic, EtherRAT, and a variant of AsukaStealer, with some campaigns attributed to the initial-access broker Woodgnat, also known as KongTuke.
Buhtrap RAT Resurfaces in New Campaign Targeting Russian Accountants via Search Ads
Specialists from F6 have identified a fresh distribution campaign for the Buhtrap RAT remote access trojan. Attackers continue to lure accountants and lawyers to counterfeit professional websites promoted through search engine advertisements. The latest lure mimics the legitimate resource Glavnaya Kniga Bukhgaltera, where visitors seeking documents instead receive a ZIP archive containing malicious payload delivered through JavaScript interception. The infection chain remains largely unchanged from prior operations, with the primary update being refreshed command-and-control infrastructure. Buhtrap has operated since 2014 as both malware and an associated criminal group; its source code leak in 2016 enabled wider adoption by financially motivated actors. Identified decoy domains include glavaudit.org, buhotchet.com, and audit24.org. Users are advised to verify site addresses carefully and avoid executing disguised EXE files.
Brazilian Malware BraZetsu Uses AI to Map and Sell Compromised Corporate Networks
Researchers have identified a new Windows malware called BraZetsu developed by the Brazilian actor Exilware. The tool maps compromised corporate networks, identifies high-value systems, and prepares access for sale to other criminals. The operation primarily targets Brazil and other countries in Latin America and the Iberian Peninsula. BraZetsu is written in Python with a modular architecture and maintains WebSocket communication with its command-and-control server. It searches for banking software, ERPs, e-commerce platforms, industrial environments, development tools, backup systems, and security solutions. The malware also looks for Brazilian CNAB financial files, digital certificates, and browser history. Evidence suggests heavy use of generative AI during development, with an AI component on the server that may classify stolen files and prioritize valuable machines.