Keeping an Online Pharmacy Safe from Scraping Attacks

Customer profile

• Online pharmacy serving eight European countries
• Provides health and wellness products to over 5M customers
• Market leading position in Germany, France, Spain and Italy

Results

• Competitor price scraping and inventory hoarding mitigated
• Risks of performance issues and outages alleviated
• Re-platforming projects supported by slick server-side integration

The challenge

The customer is one of the largest privately owned online health and wellbeing groups in Europe. They are a high-growth business, operating online pharmacies across eight countries where they provide health and wellness products and medication to over five million customers.

The security team noticed malicious automated traffic was targeting its online stores. Many of their competitors were using bots to aggressively scrape their websites, seeking to undercut prices and steal away customers.

This high-volume scraper bot activity was putting a strain on their web infrastructure, creating a risk of performance issues and outages, especially at peak times. Downtime was an unacceptable scenario, as customers rely on the site for essential medicine and other important health and wellbeing products.

Bots were also responsible for inventory hoarding, where items were added to baskets automatically with no intention to purchase. This was causing stock availability issues, impacting sales and frustrating customers who needed access to those items.

The business was relying on their WAF to block bots, but this had proven ineffective against the advanced adversarial tactics at play – for example, bots were using a huge number of IP addresses to distribute their requests, and rapidly cycling through user agents to find ways around defenses.

With a multistage re-platforming project planned, the organization needed to quickly protect their site availability, customer experience and revenue from bad bots without impeding their technical roadmap.

The solution

After researching the most reputable bot protection solutions on the market and soliciting advice from industry analysts, the security team approached a handful of vendors, including Netacea.

After assessing the situation, Netacea recommended an Offline Bot Audit project, allowing our data team to quickly analyze the traffic profile and apply machine learning models to detect malicious bot activity within expected website actions.

In our initial findings, we identified that bad bots accounted for millions of requests in the span of a week, making up 57% of all website traffic. These automated requests were globally distributed across tens of thousands of IP addresses, but Netacea identified the commonality of the bots’ behavior using our dynamic clustering machine learning models. We were also able to identify the intent and source of the attacks, quantifying the damage they were causing to the webstore when left unmitigated.

The security team was impressed by the level of bad bot traffic Netacea was able to quickly identify, which exceeded competitors without needing to deploy agents or introduce a complex integration.

Server-side simplicity

Commenting on why they chose Netacea Bot Management in light of planned platform changes, the Head of Architecture notes that not needing to deploy agents was a game changer. “Because Netacea is server side, we knew that their technology would have much less impact on our re-platforming.”

The server-side integration between Netacea and the customer has made switching technology stacks, and even their CDN in the last few years, very simple. Using an agent-based solution would have caused a complex, resource-intensive migration of their bot protection on every site. In their words, “server side was much better and led to easier re-platforming for us.”

The outcome

Netacea is now fully integrated into the customer’s security stack​ for Southern Europe​. Incoming web requests are routed via their CDN into the Netacea detection engine for analysis, and recommendations to allow or mitigate are sent back automatically with no perceptible latency.

This simple no-code integration also made it straightforward to deploy advanced bot protection across other sites, keeping customers across multiple countries safeguarded against the impact of bad bots.

Bot traffic under control

Since implementing Netacea Bot Management across several websites serving different countries, the customer has kept bot traffic well under control and mitigated the risk of performance issues and outages – even at extremely busy times like Black Friday.

Their Head of Architecture says since working with Netacea, the business can be excited for Black Friday without worry of bots threatening their website and product availability. “Last year, with Netacea's enhanced protection, we experienced a more robust and seamless website performance, especially during high-traffic events like Black Friday. This additional layer of security has given us greater confidence in providing our customers with a fast and uninterrupted shopping experience.”

As Netacea’s machine learning models have adapted to the ever-changing bot landscape over time, the customer has benefited from always up-to-date protection without the need for deploying new versions or add-ons.

The team were also impressed by the level of service and support provided by the Netacea customer success team. A central Slack channel provides direct communication and quick answers to questions. This is invaluable reassurance during re-platforming projects and at peak trade times, and the relationship between the two team remains highly collaborative and supportive.