Sneaky bots haunted another record Cyber Week
Three years after the Stop Grinch Bots Act of 2021 was proposed, it still hasn’t passed. Meanwhile, the automated scalpers, scraper and credential-stuffing tools it targeted have only gotten busier. During Black Friday 2024, Cloudflare’s network-wide observations showed:
- Grinch Bots accounted for 29% of all traffic, with absolute bot traffic 4x higher than in 2021.
- AI bots made up 1% of traffic, mostly from Claude, Meta and Amazon; 71% of those requests were allowed through.
- 63% of all login attempts were bot-driven, down slightly from the prior month, while human logins on e-commerce sites climbed 7-8%.
Today’s shopping calendar extends well past Cyber Monday into a multi-week stretch of flash sales and pre-orders. That lengthens the attack surface for bots looking to hoard inventory, abuse promo codes or take over accounts.
Grinch activity on retail sites
Shopping peaked at record levels on Black Friday, with e-commerce sites seeing 405 billion requests, 81% of that day’s traffic. That represented a 50% surge week-over-week and a 61% increase from the prior month.
The bots were just as busy. E-commerce bot traffic hit 103 billion requests, accounting for up to 19% of all traffic to online stores — nearly one in five requests wasn’t a real customer. 
How the grinches operate
Cloudflare saw 4x more bot requests than in 2021, and its traffic analysis revealed how concentrated the attacks have become:
- 19% of e-commerce traffic was Grinch Bots
- 1% of e-commerce traffic came from AI bots
- 63% of login attempts network-wide were bot-generated
- 22% of bot activity originated from residential proxy networks
AI bots crawl for training data
AI-driven bots went from zero in 2021 to 1% of all bot traffic this year. On Black Friday alone they generated 29 billion requests. Meta-external, Claudebot and Amazonbot led the pack — their owners use them to augment training data for Llama, Claude and Alexa respectively. 
Account takeover bots probe login pages
Bots also hammered account endpoints. They sent 14.1 billion requests to /login on Black Friday, making up 63% of that day’s logins. Humans only accounted for 36% of traffic to login pages that day, though that figure was up 7-8% from the prior month, suggesting deal-driven shoppers authenticated more frequently. Human logins peaked at around 40% on the Monday before Thanksgiving and again on Cyber Monday.
Cloudflare also logged a 37% increase in leaked passwords used in login requests compared to the previous month. Combined with the fact that 65% of internet users are exposed to account takeover via reused leaked passwords, this surge points to a systemic weak spot in both human and bot credential habits.
Residential proxies hide bot origins
22% of bot traffic, whether scraping or hoarding, routed through residential proxy networks. Those requests look like they come from home broadband users rather than cloud providers, which defeats defenses built on IP reputation and rate limiting. The massive pool of addresses also lets attackers cycle IPs indefinitely, shrinking the window for detection. This trend has held steady through the year.
Four rules for the season
With 35% of all Black Friday traffic being Grinch Bots, businesses need year-round bot defense. Cloudflare offers these recommendations:
(1) Block bots. Since 22% of bot traffic comes from residential proxies, use the Bot Score to challenge sensitive actions based on network signals.
(2) Monitor for account takeover. Look for leaked credentials and anomalies on login paths using account abuse detections. See additional rule examples in the linked documentation.
(3) Rate limit account and purchase paths. Apply rate-limiting best practices to new account creation, previously unseen IPs and other network fingerprints. Use detection IDs and leaked credential checks to stop promo code abuse, inventory hoarding and takeover attempts.
(4) Block AI bots. Keep shopping features for humans by blocking AI crawlers with automatic bot blocking.
Predictions for 2025
Expect shopping seasons to lengthen further, with more human peaks across November and December. AI bots will not only crawl for data but also integrate into shopping journeys. They made up just 1% of bot traffic in 2024, yet growth will accelerate as they start mimicking human behavior and acting on behalf of users.
Evasion will also become more advanced. Bot operators will employ rotating devices, IP addresses and cookies to slip past detection. Grinch Bots are only getting smarter, so the time to implement protection is now — not just for the holidays, as these bots never take time off. 
