Bot traffic & threat trends

Human traffic’s share of total requests declined from 77.9% in July 2025 to a low of 70.7% in February 2026, before partially recovering to settle around 71.3–71.8% through the first half of 2026. That share was absorbed almost entirely by bad bots, which climbed from 9.9% in July 2025 to a peak of 20.3% in February 2026 before settling at approximately 17.6% through the second quarter of 2026.

Between July 2025 and June 2026, total traffic across all DataDome customers grew by 23.7%, while human traffic grew by 13.2%. Both figures were significantly outpaced by automated categories. Bad bot traffic grew by 124.0%, more than 9x the rate of human traffic growth. AI traffic grew by 82.3%, over 6x the rate of human traffic growth.

Web scraping is the dominant attack type by far, accounting for 70.9% of all bad bot traffic observed. The volume of scraping attempts saw a 185.2% increase over 12 months. This growth reflects both the proliferation of automated scraping tools and the rising demand for data harvested at scale, increasingly to feed AI model training pipelines.

DDoS attacks grew 39.9% and peaked at 2 billion requests in a single day in April 2026. Unlike scraping, which surged and partially corrected, DDoS showed a more consistent upward trajectory, suggesting structural growth rather than campaign-driven spikes. DDoS traffic made up 12.7% of all bad bot traffic that DataDome saw over the 12-month study period, the second largest observed attack type. 

Spamming saw a 44.9% increase over the 12-month study period, but the overall series is better characterized as a sequence of high-volume waves than as a steady increase. Spamming made up 7.9% of all bad bot traffic across DataDome’s network. 

Scalping saw a 290.7% increase. Median daily volume nearly quadrupled across the 12-month period. The bulk of scalping was not limited to a single event. Scalping activity became more consistently elevated during the second half of the study period, while still producing periodic surges.

Fake account creation grew 34.5% over the 12-month period, adding to the pressure on businesses to protect registration flows as well as login pages. Attackers commonly use browser automation frameworks such as Playwright and Chrome DevTools Protocol for fake account creation campaigns, making this activity harder to distinguish from legitimate users.

Credential stuffing is cyclical, not declining. Net growth was essentially flat, but that figure obscures a pattern of extreme spikes followed by sharp collapses. Volume surged through summer 2025, then dropped by nearly 90% over the following three months before fully recovering by early 2026 and reaching new single-day highs in April. This boom-bust cycle repeats: attackers run high-intensity campaigns, go dark, likely to refresh credential lists and rotate infrastructure, then return at full scale. Credential stuffing attempts made up 6.7% of all bad bot traffic that DataDome detected. 

Simple bots still dominate. The largest share of bot traffic, 49%, is generated by bots that do not attempt to hide their automated nature. These bots trigger WebDriver signals, a fingerprint exposed by Selenium and basic ChromeDriver automation. They are among the easiest types to detect. Yet as Part 3 of this report shows, simple bots evade detection on an average of 88.6% of websites. Attackers continue using them because they continue to work. 

Average-complexity bots account for nearly 1 in 3 bad bot requests. This tier uses browser automation frameworks — primarily Playwright and Chrome DevTools Protocol (CDP) — that more convincingly simulate legitimate browser environments. These tools expose subtle fingerprints in the JavaScript environment that are detectable, but require more sophisticated analysis than WebDriver detection alone. Playwright-based bots are widely used in scraping campaigns, fake account creation, and credential testing.

21.5% of sampled bad bot traffic was advanced enough to engage with active challenges. This segment represents payload forger activity: automated requests designed to bypass security challenges and evade anti-detection controls. We detected this behavior using signals from WebAssembly (WASM) and our Virtual Machine.

But simple and average techniques overlap more often, with 4.4% of the sample showing both WebDriver and Playwright signals in the same campaign window. This suggests attackers are deliberately layering techniques: starting a session with basic automation and escalating to more convincing browser simulation when detection is likely. This hybridization makes attribution and blocking harder; a rule that stops WebDriver bots may miss the Playwright component of the same campaign. 

However, attackers using advanced bots rarely combine them with simple or average bots within the same attack. This is most likely due to the fact that a sophisticated attacker will not want to fail by using a simple signal used by basic bots. It is also still true that attackers will most likely still leverage simple bots for vulnerability scanning and reconnaissance prior to launching an attack with more advanced bots. An attacker might also leverage simple bots for easier targets in order to avoid wasting resources. 

The implication: Bot defenses that operate on single-signal rules are increasingly inadequate. A model tuned to catch WebDriver still leaves much of the 29.5% of traffic using Playwright exposed, and since the two signals sometimes layer within the same campaign, a defense that stops checking once it spots the first one can still miss the second. A defense built around CAPTCHA challenges might miss the 21.5% of traffic that has already solved those challenges at scale. 

Client-side signals are valuable, but they should be one layer in a broader detection strategy. Attackers can suppress or imitate browser-side signals, and some automated requests never execute client-side code because they target APIs, mobile endpoints, or direct server-side requests. Server-side analysis adds visibility into network characteristics, request sequencing, endpoint sensitivity, and session behavior. The strongest defenses combine client-side and server-side signals with behavioral and intent analysis in real time.