Malicious bots are growing at a startling pace as AI continues to expand. A new report from DataDome finds that from July 2025 to June of this year, bad automated traffic grew 124%. That’s nine times faster than human traffic growth during that period. AI traffic, meanwhile, increased more than 82%.
The report, based on more than 1 trillion requests across 75,000-plus customer sites, offers one of the most comprehensive looks at bot traffic online. And the bots were busy over the past year.
Scraping of sites increased more than 185%. Bots were used for scalping activity, for tickets or other high-demand items, at nearly three times the pace of the previous year. And AI bots are targeting login pages at eight times the rate they were when the 2025 report was conducted.
“Automated traffic isn’t just a volume problem at the edge of the internet anymore. It’s growing fast, and it’s going deeper: into the login, account, and transaction flows at the center of the customer journey,” says Jérôme Segura, VP of threat research at DataDome. “For businesses, the challenge is no longer simply identifying automation; it is determining whether that activity is beneficial or harmful.”
During the study period, DataDome detected 52.7 billion crawler requests from AI agents and LLMs, with more than 46% of those coming from Meta-affiliated systems. OpenAI was the second-busiest bot dispatcher, accounting for nearly 35% of the total.
The fact that bots are now moving beyond homepages and accessing login pages underscores security concerns that have been growing for some time. DataDome tested 20,000 websites and found that 65.3% had no protection against the 10 bot types included in its study. A mere 2.4% of sites were fully protected, significantly lower than the 8.4% in 2024 and slightly below last year’s 2.8%.
“Automated traffic is moving deeper into sensitive parts of the customer journey,” Segura says. “Login pages, account-creation flows, carts, and payment end points connect directly to customer accounts, personal information, inventory, promotions, and transactions. Abuse at those end points can create a ton of problems for credential testing, account takeover, card testing, inventory abuse, promotion abuse, and fraudulent transactions.”
Businesses face threats, too, including fraud, chargebacks, and refunds. (It’s worth noting that the DataDome report looks at attempts, rather than successful attacks on login pages.)
While the 185% increase in scraping is striking, it may not be entirely surprising given the rise of AI. The increase in bot use for scalping, however, could have big implications for businesses and artists. “Scalping turns a company’s best customers into its angriest ones,” says Ted Miracco, CEO of cloud software platform Approov. That can result in lower margins, lost customer goodwill, and inventory issues.
The DataDome findings come a few months after data from Cloudflare showed that bots accessing websites outnumbered human web users, with 57.4% of web traffic coming from bots, a trend that has increased to 62.5% since then.
Despite that report, and DataDome’s own findings showing a rise in automated traffic, Segura says it’s not a sign of the oft-repeated theory of a looming “dead internet,” in which the internet is primarily filled with bot activity and automated content rather than human-created connections.
“No, these findings don’t support the ‘dead internet theory,’ and they can’t determine the composition of the entire internet,” he says. “Across our customer traffic analysis, while we found automated traffic grew at a rate of 9x faster than human traffic, humans still generated 73.4% of requests. . . . A future dominated by harmful bots is not off the table just yet, but businesses will need to move beyond static identity-based controls and make better real-time decisions about what automated traffic should be allowed.”