Since Bot technology has improved vastly over the past few years, it’s also used to web attack as well. These bots are called malicious bots, applicable in various ways. The bot is a computer, not a normal person, but it connects to a web server like a person. Since the criteria to distinguish bots and people are increasingly becoming obscure, blocking malicious bots are becoming more difficult. Blocking all bots can’t be an option since not all bots are malicious. Websites like Google or Baidu uses bots in many ways such as marketing purposes or for testing web services. The malicious bots upload malicious file and attack the web service. Mostly an attacker makes bot that is difficult to distinguish from a person and attacks the target web server. Attacks include Data theft, uploading malicious file, xss, SQL injection, etc. Thus, malicious bots allow attackers to perform a wide variety of attacks. Advertise Fraud is one of these variations. Advertise fraud does not target the web server, but uploads advertisement to redirect users to malicious server or reduce the reliability of Web services. An attacker can use a bot for web server forgery by scraping the web server as well. Fraudulent servers are very difficult to distinguish because they use the same page structure, image, and text contents downloaded from the real server. They may contain malicious files and attack normal users. It can also use payment page to collect personal information. This is also a dangerous attack that can lower the reliability of a web server, by misleading the normal users to the copied server instead of the original server. Let’s have a look at typical, normal bot. Like Google bot. In the case of normal bots, the types of web servers are investigated in advance to provide search services, or even check for malicious activity. Theses bot contains bot name in every request data through user-agent, so you will know it’s actually not a person. However, there are also malicious bot disguised as normal bot, so it is important to have protection protocol.