The internet's population is shifting, and humans are becoming the minority faster than anyone expected.
The Summary
- Bad bot traffic grew 124% year-over-year, nine times faster than human traffic, according to DataDome's analysis of 1 trillion requests across 75,000+ sites
- Site scraping jumped 185%, while AI bots are targeting login pages at 8x last year's rate
- Only 2.4% of websites have full protection against the 10 most common bot types, down from 8.4% in 2024
- Meta accounts for 46% of all AI crawler traffic, with OpenAI at 35%
The Signal
The numbers tell a story about ownership. When malicious bot traffic grows 124% in a single year while human traffic crawls forward at 14%, we're watching the fundamental economics of the web flip. DataDome's analysis covers more than 1 trillion requests, making this one of the most comprehensive bot traffic studies available. The data shows AI agents and LLMs generated 52.7 billion crawler requests in the study period alone.
What's striking isn't just the volume. It's where these bots are going. They've moved past homepage scraping into the guts of user flows: login pages, account creation, shopping carts, payment endpoints. The places where actual value gets created and extracted.
"Automated traffic is moving deeper into sensitive parts of the customer journey."
Here's the breakdown of what bots are doing:
- Site scraping up 185% year-over-year
- Scalping activity (tickets, high-demand items) up nearly 3x
- AI bot targeting of login pages up 8x from 2025
The Meta and OpenAI numbers matter because they reveal the training data arms race. Meta's systems account for 46% of all AI crawler traffic, OpenAI for 35%. Together, they're responsible for more than 80% of the AI agents systematically reading the web. They're not asking permission. They're not paying. They're just taking.
The defense numbers are worse than the offense numbers. DataDome tested 20,000 websites and found that 65.3% had zero protection against the 10 most common bot types. Only 2.4% were fully protected, down from 8.4% the previous year. Website operators are falling further behind, not catching up.
This creates a selection pressure. Sites that can't defend themselves get scraped into training data. Sites that can defend themselves either pay for expensive bot detection services or lose legitimate traffic to false positives. The middle ground is disappearing.
The Implication
If you run a site with user accounts, payment flows, or inventory systems, you're already under siege whether you know it or not. The 65% of sites with no bot protection aren't making a strategic choice. They're just undefended.
The Web4 angle here is clear. As AI agents become more capable, they'll need to identify themselves and pay for access, or we'll end up with a web that's just bots talking to bots while humans get priced out by security overhead. The sites that survive will be the ones that can tell good automation from bad automation, fast. Start testing bot detection now. By the time you notice the traffic patterns, you're already months behind.