DataDome

Total AI traffic increased 82.3% during the study period.

Between July 2025 and June 2026, malicious automated traffic grew more than nine times faster than human traffic.

In H1 2026, AI agents generated 605.6 million requests to login pages, forms, carts, payment flows, and account-creation pages, with login pages accounting for 51.7% of those requests.

Real estate accounted for 17% of agentic browser traffic in early 2026.

E-commerce and retail accounted for roughly 20% of agentic browser traffic.

ChatGPT-User was the second most impersonated agent in early 2026.

Nearly 6 in 10 domains in Latin America were completely exposed to bots.

61% of enterprises with 10,001+ employees were completely unprotected against bots.

In North America and Europe, over 60% of websites lack any bot protection.

Bad bot traffic increased 124% between July 2025 and June 2026.

Scraping accounts for 70.9% of bad bot traffic and increased 185.2% year over year.

Fake account creation grew 34.5%.

In the expanded scan, 65.3% of tested websites stopped none of the 10 bot types evaluated.

Only 2.4% of tested websites stopped all evaluated bot types, down from 8.4% in 2024 and 2.8% in 2025.

Scalping activity increased 290.7%.

Travel and tourism accounted for 15% of agentic browser traffic in early 2026.

DataDome’s network recorded 7.9 billion AI agent requests in January and February 2026, a 5% increase QoQ.

Meta ExternalAgent accounted for nearly 25% of top AI agent traffic on DataDome’s network in February 2026, followed by ChatGPT-User (19.1%) and Meta WebIndexer (14.3%).

Meta-ExternalAgent was the most impersonated agent in early 2026.

Only 2.8% of websites were fully protected against bots in 2025, which is down from 8.4% in 2024.

In Latin America, only 3.5% of websites were fully protected against bots.

In 2025, 5% of AI bot traffic reached checkout flows.

In Asia Pacific, just 1.6% are fully protected against bots.

In 2025, 64% of AI bot traffic reached forms.

LLM crawler traffic rose from 2.6% of verified bot traffic in January to over 10.1% by August.

88.9% of domains disallow GPTBot in their robots.txt files.

Government, Non-Profit, and Telecoms sectors have the weakest protection against bots.

LLM crawler traffic quadrupled across DataDome’s customer base in 2025.

Only 2% of domains with over 30M monthly visits were fully protected against bots.

Travel & Hospitality, Gambling, and Real Estate led the way with the highest combined rates of full and partial protection against bots.

DataDome alone detected nearly 1.7 billion requests from OpenAI crawlers in a single month.

In Latin America, 38.5% of websites were partially protected against bots.

In 2025, 23% of AI bot traffic reached login pages.

In 2025, anti-fingerprinting bots were only blocked by ~7% of websites.

In 2025, fake Chrome and curl bots were detected just 21% of the time.

Latin America had the highest share of protected websites against bots.

Among enterprises with 10,001+ employees, just 2.2% had full protection against bots.

AI bot and crawler traffic now makes up more than 1 in 10 verified bot requests.