Botnets, scrapers and AI attacks: Why web security must evolve

The rise of large-scale DDoS attacks and rampant AI scraping signals a turning point in web security. What used to be rare is now routine — and often automated by actors with little more than a credit card.

In just the last year, attacks powered by worldwide networks of hijacked devices — called botnets — have exploded in size and number. According to cybersecurity firm Qrator Labs, a single botnet discovered in early 2025 controlled over 1.3 million devices, making it one of the largest ever recorded. Cloudflare, a major web security provider, reported a 358% increase in distributed denial-of-service (DDoS) attacks in just one year, including record-breaking attacks that flooded websites with more than 6 terabits of traffic per second (that’s enough data to stream over 250,000 high-definition movies simultaneously).

One major sports site received over 13 million visits from AI bots each month, compared to just 600 from real people... Brightspot hasn’t seen anything that extreme, but 40% of requests being from automated sources is not uncommon

From the meaning of denial of service to DDos protection in case of attack, here’s everything you need to know about DDos attacks from Brightspot’s Chief Privacy and Security Officer, David Habib.

At the same time, we’re still tracking a sharp increase in traffic from runaway web scrapers — automated tools that aggressively harvest content from websites, often with little regard for the strain they place on the sites they target. According to data from TollBit, one major sports site received over 13 million visits from AI bots each month, compared to just 600 from real people: more than 21,000 to one. Brightspot hasn’t seen anything that extreme, but 40% of requests being from automated sources is not uncommon.

As individuals and companies race to train AI models, these scrapers are being deployed by the hundreds — and not necessarily by experts. Access to these tools is easier than ever — one doesn’t even need to descend into the “dark web” anymore to purchase DDoS or scraping services. It doesn’t take expertise, or even very much money, to lease a scraper or buy a 30-minute DDoS attack.

Brightspot is collaborating with partners like Amazon Web Services to make cost-effective DDoS protections and content filtering available to our customers, and we’re stepping up our customer outreach and awareness campaign around these issues. Contact us today to learn more.

As Brightspot’s CIO, David is responsible for our Security and IT functions as well as playing advisory roles in both Managed Services and Customer Success. David has been the CIO since October of 2018.
Related reading
Brightspot manages updates, upgrades, security patches, storage, bandwidth and more, allowing you to focus on creating exceptional experiences for your customers.