How Bot Expertise Stopped the Google Translate Bot Proxy Technique
The Growing Challenge of Bot Attacks
Bot attacks are evolving to become more sophisticated. Attackers have built businesses around the data and assets they extract with bots, so they constantly seek ways to bypass defenses. Developers work tirelessly to assess bot defenses and find new methods to evade them.
Traditional, client-side defenses are visible to attackers, making it easier for them to bypass. But even advanced defenses must stay alert, embedding bot expertise to keep pace with these evolving tactics.
Case in point – the Netacea data science team recently identified a new attack technique. Web scrapers were using Google Translate as a proxy to scrape product data freely and at scale. However, the unusual traffic patterns triggered our investigation, leading us to a quick solution for our happy customer.
Detecting a Hidden Threat
One of our clients, a popular shoe retailer, frequently faces bot attacks from scalpers. These attackers use scraper bots to monitor product pages for stock availability and quickly buy limited-edition items for resale. Thankfully, our machine learning models catch this activity through intent signals and links to known bad actors.
In this case, the data team noticed an unexpected spike in traffic from a Google user agent, specifically Google Translate. Bots often disguise their user agents to appear like legitimate sources, such as Google or Bing, which are commonly trusted tools. To avoid user agent spoofing, Netacea Bot Protection checks these requests’ IP origins and blocks unverified sources.
However, in this case the requests genuinely originated from Google’s servers, matching Google Translate’s user agent. This triggered our team to investigate further.
Uncovering Suspicious Traffic Patterns
At first glance, the traffic spike seemed innocuous, as though more users wanted to translate the site. But our Netacea Bot Protection solution focuses on detecting malicious intent by analyzing the entire traffic profile. Despite the traffic’s origin, the sustained high request volume to content-heavy paths indicated a scraping attack.
Our next step was to consult the Netacea Threat Intel Center, our crack team of security researchers. These undercover experts hold vital insights from various bot communities and attacker forums. Using this knowledge, the team quickly identified the possibility that the attackers were using Google Translate as a proxy.
How Google Translate Acts as a Proxy
Google Translate proxying isn’t new; it has been a workaround for restricted access for over a decade. Just ask any tech-savvy student who has used the same method to get around their school’s content filters.
By requesting content via Google Translate, the service crawls the desired webpage and displays a translated version. Even if a user or bot’s IP address is blocked by the site, Google’s IPs are not. This allows bots to evade detection and scrape data, as traffic appears to originate from Google Translate.
Why Google Translate Proxy is Effective
Bot detection requires a careful balance to avoid blocking legitimate users and trusted sources. Traffic from Google, as a trusted source, is usually allowed to ensure user experience and business continuity. The Google Translate proxy loophole allows bots to evade detection, exploiting trusted traffic to carry out scraping.
How Our Team Uncovered and Blocked the Attack
Our data scientists quickly identified the traffic spike and, with guidance from the Threat Intel Center team, suspected Google Translate proxying. Thanks to these insights, the data team confirmed this technique and developed a plan. The fact Netacea Bot Protection is not a black box solution enabled quick adaptation to mitigate this new threat.
Working with the client, we recommended mitigating Google Translate requests to sensitive pages. While this could affect user translations in a small number of instances, the risk posed by the attack justified this action.
The results were immediate. As soon as we started blocking this traffic origin, we noticed a wave of bots from various origins flood the same paths that the Google Translate bot previously targeted. With their cover blown, these bots were automatically blocked. This was clear evidence that our theories were correct.
Staying Ahead of Bot Tactics
The case of the Google Translate bot emphasizes the importance of pairing intent-based bot detection with dedicated experts. Our Intent Analytics engine highlighted the anomaly, but it was the collaboration among experienced analysts that resolved the attack swiftly.
For robust bot protection, rely on intent-based detection technology and expert teams to stay ahead of evolving tactics.
