Bad Bot Traffic Outpaces Human Web Traffic 9x

Malicious bot traffic has escalated significantly, growing 124% between July 2025 and June 2026, a rate nine times faster than the growth of human web traffic during the same period. This surge in automated activity is further amplified by the rapid expansion of AI, which contributed to an 82% increase in AI traffic. The findings are detailed in a new report from DataDome, which analyzed over 1 trillion requests across more than 75,000 customer websites, providing a comprehensive overview of online bot activity.

Over the past year, bots have become increasingly aggressive in their actions. Website scraping saw an increase of over 185%, indicating a heightened effort by automated systems to extract data. Scalping activity, used for acquiring high-demand items like tickets, nearly tripled compared to the previous year. Furthermore, AI bots are now targeting login pages at eight times the rate observed when the 2025 report was conducted. Jérôme Segura, VP of Threat Research at DataDome, highlighted that automated traffic is no longer confined to the periphery of the internet but is penetrating deeper into critical customer journey elements such as login, account management, and transaction processes. The primary challenge for businesses has shifted from merely identifying automation to discerning whether that activity is beneficial or harmful.

The DataDome report identified 52.7 billion crawler requests originating from AI agents and large language models (LLMs) during the study period. Notably, more than 46% of these requests were attributed to Meta-affiliated systems. OpenAI emerged as the second-largest source of bot traffic, accounting for nearly 35% of the total. The increasing tendency for bots to bypass homepages and directly target login pages exacerbates existing security concerns. DataDome's testing of 20,000 websites revealed that a substantial 65.3% lacked any protection against the 10 bot types included in their study. This represents a significant decline in website security, with only 2.4% of sites being fully protected, a sharp decrease from 8.4% in 2024 and slightly lower than the 2.8% reported last year. Segura reiterated that automated traffic is increasingly targeting sensitive customer touchpoints, including login pages, account creation flows, shopping carts, and payment endpoints, which are central to the customer experience and business operations.