Bots

Bots are automated programs that carry out tasks on the internet in place of people. In advertising, “bot traffic” means impressions, clicks, app installs or events generated by software, with no real person behind them. Google and the Media Rating Council classify this kind of traffic as invalid traffic.

What are bots in advertising?

Not every bot is bad. Googlebot crawls pages for the search engine, and monitoring tools check whether a website is still up. The problem is bots written to imitate users so they can collect ad money or distort the numbers.

The Media Rating Council splits invalid traffic into two levels (MRC, IVT Standards Addendum, June 2020):

• GIVT (general invalid traffic): known bots and crawlers, data center traffic, and user agents that are not browsers. Filtering by list is enough, for example the IAB/ABC International Spiders & Bots List, which holds user agent strings that have produced large volumes of automated activity (ABC UK, accessed October 2026).
• SIVT (sophisticated invalid traffic): bots that pose as real users, running on emulators or on real people’s devices that have been infected with malware. Catching them takes analysis of many signals.

How much traffic comes from bots?

The 2025 Bad Bot Report from Imperva (part of Thales) found that in 2024, automated traffic made up 51% of web traffic, overtaking humans for the first time in ten years. Malicious bots alone accounted for 37%, up from 32% the year before. Imperva says AI now lets people with little skill write bots too (Imperva, April 2025). Keep in mind that these figures come from a company that sells anti-bot products.

BadBox 2.0: bots running on real devices

In June 2025, the FBI warned about the BadBox 2.0 botnet, made up of millions of IoT devices such as TV boxes, projectors, car infotainment screens and digital picture frames, most of them made in China. The devices were infected with malware before they were sold, or when apps were downloaded during setup, and were then turned into residential proxies (FBI IC3, June 2025).

In July 2025, Google sued the operators of BadBox 2.0 in federal court in New York. According to Google, the botnet had taken control of more than 10 million uncertified devices running open-source Android and used them for ad fraud at scale. Google updated Play Protect to block the related apps automatically (Google, July 2025).

The lesson for advertisers: blocking data center IPs is no longer enough, because part of today’s bot traffic runs through real home IP addresses.

Who filters bots for you?

Google Ads filters invalid traffic automatically, including clicks and impressions generated by bots. What it detects before billing is not charged, and what it detects afterward is refunded as credit where appropriate (Google Ads Help, accessed October 2026). For apps, the MMP (mobile measurement partner) also blocks bot installs based on known signatures and abnormal behavior. With small ad networks and affiliates, you have to check for yourself.

How do bots differ from other types of fraud?

See also phone farms, click farms and SDK spoofing, a method that never runs the app and instead sends fake data straight to the measurement server.

Example (hypothetical)

An English-learning app spends 30 million VND buying impressions on a small ad network. CTR hits 4%, four times higher than its other channels, yet installs barely move. Most of the clicks come from a few foreign IP ranges and cluster between 2 and 4 a.m. Vietnam time. The app team pauses the network and asks for a reconciliation.

Frequently asked questions

Do bots damage the optimization algorithm?

Yes. Bot clicks make the system believe a placement is working, so it pushes more budget into it. See click fraud.

Will blocking all bots hurt SEO?

It will if you block search engine bots by mistake. Ad fraud filters should work at the reporting and media buying layers, and leave legitimate crawlers alone.

If you suspect a channel is charging you for bot traffic, the Adtek team can go through the data with you. Get in touch through our contact page.