DataDome report finds bad bot traffic growing nine times faster than human traffic

Malicious automated traffic grew 124% between July 2025 and June 2026, more than nine times the rate of human traffic growth, according to a new report from bot protection vendor DataDome. The findings come from the 2026 edition of its State of Bot & Agent Security Report, which analysed more than a trillion requests across over 75,000 customer sites.

Scraping accounted for 70.9% of bad bot traffic and rose 185.2% over the year, which DataDome links in part to third-party data resellers and agent builders harvesting the web for model training. Scalping rose 290.7%, fake account creation was up 34.5%, and distributed denial-of-service attacks grew 39.9%, peaking above 2 billion requests in a single day in April. Credential stuffing was flat on the year.

AI traffic grew 82.3%, with 52.7 billion AI agent and crawler requests logged. Meta-affiliated bots generated 46.3% of the identified total and OpenAI-affiliated bots 34.6%. AI agents sent 605.6 million requests to login, form, cart, payment and account-creation pages between January and June, with login pages taking 51.7% of that, up from 23% a year earlier.

In a June test of 21,491 popular websites, 65.3% stopped none of the 10 bot types sent at them, and only 2.4% reached full protection, down from 8.4% in 2024. Spoofed AI agents bypassed more than seven in ten sites, and only 5.5% caught a bot forging a real browser’s network fingerprint. Jerome Segura, DataDome’s vice president of threat research, said the harder question is now whether a given session is beneficial or harmful.