The internet is becoming increasingly automated, with bots, AI crawlers and autonomous agents accounting for a growing share of global web activity.
New analysis from Decodo shows that the United States generates 53.5% of global bot traffic, placing it far ahead of every other country. Germany ranks second with 8.2%, followed by the Netherlands at 5.6% and Singapore at 5.4%.
The findings come at a time when AI-driven web activity is accelerating rapidly. During 2025, agentic AI traffic increased by approximately 7,851% year-on-year, while overall AI-driven traffic grew by around 187%, according to research from HUMAN Security.
This shift is changing how websites are accessed and how businesses need to think about digital visibility, cybersecurity and customer acquisition.
AI systems are no longer simply generating content for users. They are increasingly browsing websites, retrieving information, comparing products, visiting account pages and beginning to participate in commercial interactions.
The United States Dominates Global Bot Traffic
Decodo’s analysis highlights the scale of automated traffic originating from major digital markets.
The United States accounts for more than half of global bot traffic, significantly ahead of other countries.
Top 20 Countries for Global Bot Traffic
| Rank | Country | Share of Global Bot Traffic | Bots as % of Own Traffic |
|---|---|---|---|
| 1 | United States | 53.5% | 43.6% |
| 2 | Germany | 8.2% | 45.0% |
| 3 | Netherlands | 5.6% | 61.3% |
| 4 | Singapore | 5.4% | 73.7% |
| 5 | France | 3.9% | 33.1% |
| 6 | China | 3.9% | 38.4% |
| 7 | India | 3.5% | 14.9% |
| 8 | Ireland | 3.4% | 71.1% |
| 9 | United Kingdom | 3.3% | 21.1% |
| 10 | Brazil | 3.2% | 15.9% |
| 11 | Japan | 3.0% | 17.6% |
| 12 | Russian Federation | 2.7% | 40.5% |
| 13 | Iran | 2.4% | 81.4% |
| 14 | Hong Kong | 2.2% | 55.6% |
| 15 | Indonesia | 1.9% | 18.2% |
| 16 | Canada | 1.9% | 20.8% |
| 17 | Vietnam | 1.7% | 24.8% |
| 18 | South Korea | 1.3% | 21.5% |
| 19 | Finland | 1.1% | 56.8% |
| 20 | Australia | 1.1% | 20.3% |
Source: Decodo, 2026
The data also reveals a significant difference between a country’s share of global bot traffic and the proportion of its own traffic that is automated.
Bots account for 43.6% of total web traffic in the United States and 45% in Germany. In the Netherlands, however, bots account for 61.3% of traffic, while Singapore reaches 73.7%.
Iran records the highest proportion among the countries listed, with automated activity representing 81.4% of its web traffic.
These figures demonstrate that countries producing a smaller share of global traffic can still have highly automated domestic web environments.
It is also important to note that the apparent geographic origin of bot traffic may reflect hosting infrastructure, cloud services, proxies or data centres rather than the physical location of the organisations controlling the bots.
Bots Are Becoming the Majority of Web Traffic
The rise of automated traffic is part of a wider transformation of the internet.
Decodo reports that bots now account for 57.4% of global web requests, compared with 42.6% generated by human users.
Other cybersecurity research has identified a similar trend.
The 2025 Imperva Bad Bot Report found that automated traffic represented around 51% of internet activity in 2024. Malicious bots alone accounted for 37% of all traffic, up from 32% a year earlier.
The growth of generative AI is now accelerating this shift further.
HUMAN Security found that automated traffic grew significantly faster than human activity throughout 2025, based on an analysis of more than one quadrillion digital interactions.
AI-generated traffic is also evolving beyond conventional crawlers.
Training bots remain an important source of activity, but autonomous agents and AI-powered scrapers are expanding at a much faster rate.
Agentic AI Traffic Surges
One of the most significant developments is the rapid growth of agentic AI.
According to HUMAN Security, agentic AI traffic increased by approximately 7,851% during 2025.
AI agents differ from traditional search crawlers because they can carry out more complex actions.
Instead of simply indexing a webpage, an AI agent may search for products, compare information, navigate account areas, fill in forms or interact with a website on behalf of a user.
HUMAN found that around 77% of agentic AI activity reached product and search pages during 2025.
A further 8.8% reached account-related pages, 5% interacted with authentication flows and 2.3% reached checkout pages.
These patterns suggest that autonomous systems are moving closer to the parts of websites where purchasing decisions and transactions occur.
From Search Engines to AI Assistants
For much of the internet’s history, businesses designed websites primarily for human users and search engines.
That model is beginning to change.
AI assistants are increasingly becoming intermediaries between users and websites.
Instead of manually opening multiple pages to research a product or service, users can ask an AI assistant to conduct that research for them.
The assistant may browse websites, gather information, compare prices and features, and return a recommendation without the user directly visiting many of those pages.
This creates a new layer of digital competition.
Companies may increasingly need to optimise not only for traditional search engines and human visitors but also for AI systems that retrieve, interpret and recommend information.
Retail and Ecommerce Are Major Destinations for AI Traffic
Retail and ecommerce websites are already experiencing significant levels of automated activity.
Decodo reports that retail accounted for approximately 62.5% of AI training crawler activity, making the sector particularly important for AI systems gathering product and commercial data.
This is not surprising.
Retail websites contain large volumes of frequently changing information, including prices, availability, product descriptions, specifications and reviews.
AI systems need access to this information if they are expected to answer shopping-related questions or compare products on behalf of users.
HUMAN Security has similarly found that retail and ecommerce, streaming and media, and travel and hospitality account for the majority of AI-driven traffic.
The trend suggests that ecommerce platforms may become some of the first environments where autonomous AI agents operate at scale.
Not Every Bot Is Malicious
The expansion of bot traffic creates a difficult challenge for businesses.
For years, many organisations have treated automated traffic primarily as a cybersecurity threat.
That approach is becoming less effective as legitimate AI systems increasingly rely on automated access.
Some bots are clearly harmful. They may scrape proprietary information, attempt credential attacks, commit fraud or overload systems.
Others provide legitimate services, including search indexing, AI-assisted browsing and user-directed research.
As a result, businesses need to distinguish between harmful automated activity and trusted AI systems.
Vaidotas Juknys, CEO at Decodo, said:
“The instinct to block every bot is understandable, but not every automated visitor is malicious. As AI assistants become another way consumers discover products and services, businesses need to distinguish between harmful bots and legitimate AI systems. The agents crawling websites today may become how customers discover brands tomorrow.”
This distinction is likely to become increasingly important.
A company that blocks every automated system may protect itself from certain threats, but it could also reduce its visibility across emerging AI-powered search and shopping platforms.
Cybersecurity and Digital Visibility Are Converging
The rise of AI agents is beginning to blur the boundary between cybersecurity and marketing.
Traditionally, cybersecurity teams focused on blocking malicious traffic, while marketing teams focused on increasing website visibility and attracting users.
AI changes that relationship.
Some automated visitors may represent security risks. Others may represent potential customers acting through AI assistants.
Businesses therefore need to understand not only whether traffic is automated, but also who is generating it, what it is trying to do and whether it can be trusted.
Verified identity and behavioural analysis may become more important than simple bot detection.
This could lead to a new generation of systems designed to manage relationships between websites and AI agents.
Website Analytics May Need to Change
The growth of machine-generated traffic also has major implications for analytics.
Traditional website metrics such as page views, sessions, bounce rates and conversion rates were developed around human behaviour.
These metrics become more difficult to interpret when a growing share of visits is generated by automated systems.
If an AI assistant visits a product page, gathers information and then recommends that product to a user, the commercial influence of that visit may not be captured by conventional analytics.
At the same time, businesses need to separate legitimate AI traffic from malicious automated activity when evaluating performance.
This could push organisations towards new measurement frameworks that distinguish between human visitors, traditional crawlers, AI training systems and autonomous agents.
AI Visibility Could Become a New Competitive Metric
The rise of AI assistants may also create a new type of digital visibility.
For years, companies have competed for rankings on Google, reach on social media and visibility across digital advertising platforms.
They may soon also compete for inclusion in AI-generated recommendations.
If consumers increasingly ask AI systems which product to buy, which service to use or which company to trust, then being correctly represented inside those AI systems becomes commercially important.
Structured data, accurate product information and accessible website architecture could therefore play a larger role in how businesses are discovered.
AI visibility may become an extension of SEO, ecommerce optimisation and digital reputation management.
Building for the Agentic Internet
The rise in bot traffic is not simply a cybersecurity story.
It represents a deeper change in the architecture of the internet.
Websites are becoming environments accessed by humans, conventional bots and increasingly sophisticated AI agents at the same time.
Businesses will need to adapt accordingly.
Cybersecurity teams will need better ways to distinguish harmful automation from legitimate AI activity.
Marketing and ecommerce teams will need to understand how AI systems discover and interpret their content.
Analytics teams will need more accurate methods for separating human and automated behaviour.
And website owners will need to determine which AI systems they want to allow, which they want to restrict and how those decisions affect their visibility.
The key question may therefore no longer be whether a website visitor is human or a bot.
Instead, organisations will increasingly need to understand the intent, identity and value of every digital interaction.
Sources
- Decodo — Bot Traffic vs. Human Traffic: AI Took the Web
https://decodo.com/blog/bot-traffic-vs-human-traffic - HUMAN Security — 2026 State of AI Traffic & Cyberthreat Benchmark Report
https://www.humansecurity.com/learn/resources/2026-state-of-ai-traffic-cyberthreat-benchmarks/ - Cloudflare — A Deeper Look at AI Crawlers: Breaking Down Traffic by Purpose and Industry
https://blog.cloudflare.com/ai-crawler-traffic-by-purpose-and-industry/ - Cloudflare — The Crawl-to-Click Gap: AI Bots, Training and Referrals
https://blog.cloudflare.com/crawlers-click-ai-bots-training/ - Thales / Imperva — 2025 Bad Bot Report
https://cpl.thalesgroup.com/about-us/newsroom/2025-imperva-bad-bot-report-ai-internet-traffic - Imperva — 2025 Bad Bot Report
https://www.imperva.com/resources/resource-library/reports/2025-bad-bot-report/
