How Travel Platforms Can Respond to Bots and API Attacks in the Age of AI Travel Booking
Summary
Travel platforms should first identify the APIs directly connected to revenue, including pricing and inventory, login, loyalty points, booking, and payment APIs.
Rather than examining individual requests or IP addresses alone, platforms should analyze the entire booking journey, including repeated searches, booking completion, and direct API calls.
BotManager identifies malicious automation and abnormal API access, while NetFUNNEL manages the entry volume of approved legitimate traffic.
In the age of AI travel booking, platforms need to determine both who should be allowed through and how quickly they should be admitted.
How do you prepare for a trip?
With summer approaching, many people are likely planning their vacations and preparing for upcoming trips. As generative AI becomes more widely used, the way people plan their travel has also changed significantly.
Instead of visiting multiple websites to compare the prices and conditions of travel products, more people are now telling AI their destination and schedule and asking it to recommend suitable travel options.
For travel platforms, the increase in discovery through generative AI represents a new customer touchpoint. At the same time, however, it also creates new operational challenges.
Legitimate AI agents, search crawlers, price-collection bots, account takeover bots, and booking macros all access the same websites and APIs. The key question is no longer simply whether bots should be blocked.
Which automated requests should be allowed, which should be restricted, and how should approved traffic be managed within the system’s processing capacity?
Based on Akamai’s latest State of the Internet security report, Securing the Agentic Storefront: Attacks on Commerce, this article examines the areas that travel and booking platforms operating in the APAC region need to review.
Why Are Travel and Booking Platforms in APAC Highly Exposed to Bots?
The APAC travel market has a high proportion of online and mobile bookings. Airlines, hotels, online travel agencies, payment providers, and loyalty systems are also connected through complex networks, creating numerous points that automated traffic can access.
In its report, Akamai identifies the following factors as contributing to the travel industry’s high exposure to bots in APAC.
1. Fragmented Travel Service Providers
The travel booking process involves multiple businesses, including airlines, hotels, online travel agencies, price comparison services, payment providers, and loyalty programs.
Their systems exchange pricing, room availability, seat inventory, customer information, and booking status through APIs. As the number of connected platforms and APIs increases, legitimate integrations grow—but so does the number of potential entry points available to attackers.
2. High-Value Loyalty Points and Miles
Airline miles and hotel points can be used to purchase flights and accommodation, giving them tangible financial value to attackers.
Akamai explains that travel loyalty programs are particularly popular in APAC and that this popularity contributes to increased account takeover and credential-stuffing activity.
3. Booking Demand Concentrated During Specific Periods
When flight and accommodation bookings surge during periods such as Lunar New Year, Golden Week, Diwali, and the year-end holiday season, legitimate user traffic and automated requests increase at the same time.
Attackers can hide within large volumes of legitimate traffic and attempt price collection, account takeover, API abuse, and service disruption attacks.
Travel platforms therefore need to examine not only the overall volume of traffic, but also who is accessing the service, how they are accessing it, and which functions they are targeting.
Why Are APIs a Major Target for Attacks on Travel Platforms?
APIs are directly connected to actual transaction functions, ranging from flight searches and customer authentication to loyalty point inquiries, booking, and payment.
According to Akamai’s research, the travel industry accounted for 22% of commerce-related web attacks in APAC, while 25% of attacks targeting the APAC travel industry were directed at APIs.
Looking at the major functions of a travel platform throughout the booking journey helps explain why APIs are attractive targets for attackers.
Booking stage | Functions handled by APIs | Potential automation risks |
|---|---|---|
Product search | Flight, room, and fare searches | Large-scale collection of pricing and inventory data |
Login | Customer authentication and account lookup | Credential stuffing and account takeover |
Points and coupons | Mileage and discount benefit verification | Point theft and automated coupon collection |
Seat and room selection | Inventory verification and temporary reservation | Repeated seat and room holding |
Booking and payment | Booking creation and payment processing | Repeated API calls and abuse of payment attempts |
Booking lookup and modification | Booking confirmation and schedule changes | Personal data access and account misuse |
Some functions that require button clicks and page transitions on a website can be executed more quickly and repeatedly by calling the API directly.
Akamai found that APIs provide direct access to pricing, inventory, loyalty, and customer information, allowing attackers to use them as entry points that bypass controls implemented in traditional web interfaces.
API web attacks targeting commerce organizations increased by 9% year over year from the fourth quarter of 2024 to the fourth quarter of 2025.
What Bot-Related Problems Can Occur on Travel Platforms?
Bot-related problems on travel platforms do not end with increased website traffic. They can also affect booking data, pricing, inventory, and the overall customer experience.
Price and Inventory Scraping
When automated bots continuously search for flight or room prices, they generate unnecessary load on search and fare-calculation APIs.
Competitors may also use these bots to collect pricing and inventory information in real time.
Account and Loyalty Program Attacks
Credential stuffing, in which stolen usernames and passwords are automatically tested across services, can lead to account takeover and the theft of miles or loyalty points.
Repeated Holding of Seats and Rooms
When automated scripts temporarily reserve seats or rooms without completing payment, inventory may appear unavailable to legitimate customers.
In the airline industry, this type of automated seat occupation is known as seat spinning.
Repeatedly searching for seats, calculating fares, and entering the booking process without proceeding to payment can distort both actual demand and the amount of inventory that is genuinely available for booking.
Reduced Service Stability
When malicious bots are not blocked, unnecessary requests accumulate across login, search, booking, and payment APIs.
If legitimate users also flood the service during a holiday period or promotion, specific APIs or databases may become bottlenecks before the rest of the system.
Bot management on travel platforms is therefore not solely a security-team responsibility. It is an issue that needs to be addressed jointly across digital service operations, booking systems, customer experience, and revenue management.
Would Blocking All AI Agents and Bots Solve the Problem?
No.
Indiscriminately blocking legitimate AI agents and business-critical automation can negatively affect customer accessibility, visibility in AI search services, and integrations with partner services.
Akamai recommends moving beyond simple allow-or-block approaches and adopting risk-based governance based on bot intent and business value.
According to the report, commerce companies are prioritizing the monitoring of more than 90% of the AI bot activity classified by Akamai and evaluating its behavior.
Travel platforms can classify automated traffic as follows.
Classification | Examples | Recommended response |
|---|---|---|
Allow | Verified search engines, partners, and approved AI agents | Permit normal access |
Monitor | High-volume automation with no confirmed harmful impact | Observe behavior and request patterns |
Additional verification | Suspicious requests accessing login, loyalty point, or booking functions | Apply authentication or additional policies |
Restrict or block | Account takeover, inventory holding, and unauthorized scraping | Rate-limit or block requests |
The key is not simply to determine whether a request comes from a bot. Platforms must analyze what the request is doing and whether its activity results in a legitimate transaction.
What Should APAC Travel and Booking Platforms Review?
1. Identify the APIs Connected to Booking Revenue
Platforms should map the entire booking journey, from product search to payment, and create an inventory of the APIs used at each stage.
The following APIs should be prioritized:
Pricing and inventory inquiry APIs
Login and customer authentication APIs
Mileage and loyalty point APIs
Seat and room reservation APIs
Booking creation and modification APIs
Payment and refund APIs
As a first step, Akamai also recommends continuously discovering API assets and identifying the APIs connected to sensitive data and revenue-generating processes.
2. Analyze the Entire Booking Behavior, Not Individual Requests
It can be difficult to distinguish a legitimate user from a bot by examining a single request.
However, differences may become visible when the entire session is analyzed.
Is the same product being searched repeatedly within a short period?
Is the same booking journey being repeated across multiple accounts?
Does the user proceed to payment after holding a seat or room?
Are APIs being called directly without normal page navigation?
Are requests unusually concentrated on particular URLs or functions?
Rather than relying only on IP addresses or CAPTCHA, platforms should analyze request frequency, navigation order, repeated behavior, and purchase intent together.
3. Design Bot Blocking and Traffic Control Separately
Even after malicious bots have been removed, large numbers of legitimate customers may still access the platform simultaneously when a holiday booking period or promotion begins.
Travel platforms therefore require both of the following measures:
Access eligibility management: Which automated requests should be allowed, monitored, or blocked?
Entry volume management: How should approved users and requests be admitted at a rate the system can process?
Malicious bot detection and large-scale traffic control are closely related, but they are not the same function.
How Can BotManager and NetFUNNEL Manage Travel and Booking Traffic?
A travel platform’s response can be divided into two stages: identifying malicious automated requests and managing the entry rate of approved traffic.
BotManager: Verifying the Behavior and Access Intent of Automated Requests
BotManager distinguishes legitimate users from malicious bots through a verification framework consisting of firewall, bot, filter, and policy layers.
In addition to IP, country, ASN, bot category, and condition-based filters, requests can be allowed, detected, or blocked according to user behavior and the context of the access attempt.
It can therefore be used to analyze automated requests that repeatedly perform booking journeys or call APIs directly.
However, BotManager should not be understood as a complete replacement for an existing web application firewall. Its specialized role is bot detection and business logic protection.
NetFUNNEL: Controlling the Entry Volume of Legitimate Booking Traffic
NetFUNNEL is a traffic management solution that places users in a virtual waiting room when traffic surges and adjusts the number of users admitted according to the system’s processing capacity.
Entry-rate control can be applied to specific URLs or API calls. NetFUNNEL can manage not only individual functions such as login and payment, but also the concurrent usage volume of an entire multi-stage booking process.
When the two solutions are used together, their roles can be divided as follows.
Management challenge | Solution responsible |
|---|---|
Detecting bots that repeatedly search pricing and inventory | BotManager |
Analyzing account takeover attempts and abnormal API calls | BotManager |
Distinguishing legitimate AI agents from malicious bots | BotManager |
Managing booking traffic surges during holidays and promotions | NetFUNNEL |
Controlling entry volume for login, booking, and payment APIs | NetFUNNEL |
Managing concurrent processing across multi-stage booking journeys | NetFUNNEL |
Improving the stability of travel and booking services should not be measured simply by the number of bots blocked.
The goal is to protect booking opportunities for legitimate customers and approved AI agents, filter out malicious automation, and manage approved requests according to the system’s processing capacity.
Traffic Management Standards Must Change in the Age of AI Travel Booking
AI agents may become an important new customer touchpoint for travel platforms.
At the same time, attackers can use AI and automation technologies to imitate legitimate user behavior and access APIs more quickly.
Travel platforms therefore need to establish new standards between two extremes: blocking all automation and allowing it without restriction.
They should first identify the APIs connected to booking revenue and classify automated traffic based on the intent and behavior of each request.
They must then manage the entry volume of booking and payment systems while also preparing for situations in which legitimate users and approved AI agents access the service simultaneously.
As exposure to bot and API attacks increases across the APAC travel market, security and traffic management should not be designed as separate, reactive measures. They need to operate as part of a unified booking management framework.
FAQ
What Is AI Travel Booking?
AI travel booking refers to a process in which generative AI or AI agents search for and compare flights and accommodation based on a user’s schedule, budget, and preferences, or perform part of the booking process on the user’s behalf.
Why Are Travel Platforms Vulnerable to Bot Attacks?
Airlines, hotels, online travel agencies, payment providers, and loyalty systems are connected through multiple APIs, while pricing, inventory, and booking information change in real time.
High mobile booking rates and the seasonal concentration of booking demand also increase exposure to attacks.
Why Are APIs Targeted on Travel Platforms?
APIs are directly connected to transaction functions such as pricing, inventory, accounts, loyalty points, booking, and payment.
Attackers can repeatedly call APIs using automation to collect data, take over accounts, or consume service resources.
How Should AI Agents Be Distinguished from Malicious Bots?
Platforms should not make decisions based only on the type of automation technology being used.
They need to analyze the access target, request frequency, booking progression, repeated behavior, and business value together.
Legitimate AI agents can be allowed or monitored, while automation that causes harm—such as account takeover or inventory holding—should be subjected to additional verification or blocked.
Learn How to Respond to AI and Bot Traffic
Even after bots are blocked, large numbers of legitimate customers may still access a platform simultaneously during holiday periods or promotions.
Alongside malicious automation detection, legitimate traffic entering booking and payment processes should be controlled according to the system’s processing capacity.