DataDome Report Finds Malicious Bot Traffic Rose 124% in 12 Months
Summary
DataDome’s report says malicious bot traffic rose 124% from July 2025 to June 2026, while 65.3% of 21,491 popular websites tested failed to detect any of 10 simulated bots. Tests covered homepages; attack traffic does not mean successful compromise.
Key points
- DataDome analyzed trillions of requests across more than 75,000 customer sites; bots and AI agents accounted for about 26.5% of traffic in its dataset.
- Malicious bot traffic increased 124% in the 12-month period, compared with 13.2% growth in human traffic; AI agent and LLM crawler traffic rose 82.3%.
- Web scraping made up 70.9% of bad bot traffic. Credential stuffing was flat year over year but had recurring high-volume waves.
- Monthly AI bot traffic to login pages increased more than eightfold in the first half of 2026, according to the report.
- In tests of 21,491 popular websites, 65.3% failed to detect any of 10 simulated bots, while 2.4% stopped or challenged all of them.
- Testing focused on homepages, so protections on login, account, or payment pages were outside its scope. Traffic classified as an attack indicates an attempted action, not a confirmed breach or loss.
Article Details
- Publisher
- DataDome
- Report Period
- July 2025 to June 2026
- Scope
- Bot and AI-agent traffic patterns, bot detection testing, and activity targeting websites.
- Sample Size
- Traffic analysis covered trillions of requests across more than 75,000 customer sites; a separate 30-day sample examined bad-bot traffic. Homepage bot-detection tests covered 21,491 popular websites.
- Key Statistics
- Malicious bot traffic increased 124% from July 2025 to June 2026, compared with 13.2% growth in human traffic.
- Traffic from AI agents and LLM crawlers rose 82.3% during the same 12-month period.
- Web scraping accounted for 70.9% of bad-bot traffic.
- About 65.3% of tested popular websites failed to detect any of the 10 simulated bots.
- Only 2.4% of tested websites stopped or challenged every simulated bot type.
- Recommendations
- Assess interactions using their sequence, speed, volume, and context rather than relying on a single request.
- Do not rely solely on browser-side signals, which attackers can suppress or imitate and which may not run for API, mobile, or server-side requests.
- Evaluate bot defenses against varied automation, including forged browser fingerprints and bots posing as recognized AI services.