Bots as a service describes criminal rental of ready made automation so buyers can run abusive online activity without building the tooling themselves.
The offer is a service relationship around automation, and this article does not describe how to find, pay, or operate such a rental.
How it works
Buyers may seek volume against logins, checkouts, promotions, or sign ups, while the operator keeps the infrastructure and changes it when defenses adapt.
The harm falls on account holders, merchants, and platforms that must tell real customers from rented scripts.
Because the buyer does not need deep skill, the pool of people who can launch abusive automation grows.
Defenders respond by raising the cost of each automated action, binding actions to real identity, and watching for shared patterns across many supposed customers.
Concrete examples
- A fraudster rents automation for a weekend campaign against a ticketing site instead of writing a custom script.
- Several small crews use the same rented service, so their traffic shares timing and browser traits even though the crews differ.
- A merchant sees account creation spike overnight, and the sessions look maintained by an outside operator rather than by one local tool.
Protective measures
- Raise the cost of repeated automated actions on account creation, login, and checkout rather than relying on a single static block.
- Watch for many accounts that share device traits, payment tools, or timing even when the names and addresses differ.
- Bind high value actions to step up checks that a rented script cannot satisfy with a password alone.
- Coordinate with payment and identity partners when the same rental pattern appears across more than one brand.
How CDPCaptcha helps
Browser proof of work makes each rented automated session spend extra computation, so buyers face a higher cost for the same volume of scripted activity.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.