DDoS and bot traffic: what is different
Contents
Share
DDoS and bot traffic are easy to mix up because both spoil access to a site. They are different events. A distributed denial of service is a denial technique that uses many nodes. Automated application traffic can fail to be a denial of service and still abuse the site: stolen passwords, content collection, buying out stock, fake reviews. Click fraud appears in that list as application abuse, not as a network flood.
You need this if the host writes “DDoS” while junk leads are rising, or the opposite: the site opens and the forms are full. Below is where the line sits and which product covers which side.
An application denial is not a network flood
The OWASP catalog calls OAT-015 Denial of Service the consumption of application resources, or a hit on individual accounts, in order to reduce availability. The use can look like ordinary use. First a slowdown, then exhaustion of the file system, memory, processes, threads, CPU, people, or money. The resources may belong to the web server, the application server, the database, or to third-party APIs, embedded third-party content, and a CDN.
The catalog explicitly sets aside HTTP floods, slow HTTP, denial at network layer 3, and denial at TCP layer 4. Other classifications cover those. The boundary of the automated-threat catalog does not cancel the existence of network DDoS. It says: do not look for that definition inside OAT-015.
If the cart “just gets slow,” that can be application consumption that looks like ordinary orders. If the link is filled with packets before the application, that is another classification, and the OAT catalog does not describe it.
How NIST separates DoS and DDoS
The NIST glossary defines denial of service (DoS) as preventing authorized access to resources or delaying time-critical operations. The critical time may be milliseconds or hours, depending on how the service works. The same glossary defines distributed denial of service (DDoS) as a denial-of-service technique that uses multiple hosts. Both definitions are tied to NIST and CNSSI documents, not to a measurement of any particular site. The glossary does not say which shop product protects against what, and it does not give a cost of downtime.
The practical reading is: one source that delays a time-critical operation is DoS. Many nodes in the same technique are DDoS. Neither equals “any bot on the site.”
Automated traffic that is not a denial
OWASP opens its bot section by saying web applications see continuous automated traffic. That traffic is not a distributed denial of service and still abuses the application. The list includes testing stolen passwords, collecting content, buying limited stock, mass account creation, gift-card cracking, carding, fake reviews, click fraud, and distorted analytics.
That is a boundary of the description, not a measurement of the DDoS share in your traffic. The site can stay up while analytics and leads are already spoiled. Waiting for a “DDoS outage” before you look at clicks and forms means waiting for a different event.
| Question | Application denial (OAT-015) | DDoS in the NIST sense | Automated traffic that is not DDoS |
|---|---|---|---|
| What is damaged | Application resources or individual accounts | Access or time-critical operations, many nodes | Logic: passwords, content, stock, reviews, clicks, analytics |
| Looks like ordinary use | It can | Not necessarily | Often yes: requests look like a client’s |
| Layer 3–4 flood | Set aside from this event | Can be the denial technique | Not required for the harm to exist |
Where Cloudflare’s DDoS protection sits
The Cloudflare DDoS Protection overview says the product automatically detects and mitigates distributed denial-of-service attacks. Managed rulesets cover layers 3/4 (network) and layer 7 (application). Unmetered protection at layers 3–7 is listed for Free, Pro, Business, and Enterprise. Advanced TCP and Advanced DNS add-ons are available to Magic Transit customers, not to every plan in a row.
That is a Cloudflare product, not a definition of every DDoS. The overview does not mention advertising clicks. Mitigating a network denial does not answer who clicks ads, how click fraud differs from sklikivanie, why an invalid click is not always refunded, or whether Yandex returns the money.
If someone says “we are under attack,” use this order:
Separate the link and the packets (layers 3–4) from an application that still answers but spends memory, people, or money.
Do not call OAT-015 a network flood: the catalog sets that flood aside.
If many nodes are involved and a time-critical operation is not completing, that is DDoS in the NIST sense. The deadline may be milliseconds or hours.
If the site opens and passwords, prices, reviews, or clicks are what break, that is automated traffic from the OWASP list, and you do not need to wait for the link to drop.
A product such as Cloudflare DDoS Protection covers distributed denial at the layers it states. On this overview it does not refund a click in an ad account.