A report from DataDome SAS indicates that malicious automated traffic increased by 124% between July 2025 and June 2026. This growth rate is nine times higher than the increase in human traffic. The findings are based on over a trillion requests across 75,000 customer sites and a test of 21,491 popular websites conducted in June.
Web scraping accounted for 70.9% of bad bot traffic, rising 185.2% over the year. Scalping activities grew by 290.7%, while fake account creation rose by 34.5%. Distributed denial-of-service attacks increased by 39.9%, peaking at over 2 billion requests in a single day in April. Credential stuffing remained flat throughout the period.
AI-related traffic grew by 82.3%, with DataDome recording 52.7 billion requests. Meta-affiliated bots accounted for 46.3% of this traffic, while OpenAI-affiliated bots made up 34.6%. Although 97.9% of AI requests targeted general content, 605.6 million requests were directed at sensitive areas like login and payment pages.
DataDome tested 21,491 sites across 15 industries in the U.S., Canada, and France. Approximately 65.3% of these sites failed to block any of the 10 bot types tested. The percentage of sites achieving full protection dropped to 2.4%, down from 8.4% in 2024. Telecommunications sites showed the lowest security, with 82.9% remaining unprotected.
