The World Cup has turned ticket pages into one of the busiest places in sport where fans log on for seats, but Thales says way too much of the traffic on sports sites is automated software.
This comes after research from Thales saying 39% of traffic to sports websites now comes from malicious bots. The same data says only 52% of sports website traffic comes from genuine human users, leaving ticket buyers in queues full of programs built to act faster than people.
That counts when tickets go on sale for high demand matches. A fan sees a loading page, a payment screen or an empty basket. Behind that, bad bots can open accounts, do things like check stock or target login pages. Then there’s the biggest one: buying inventory before real supporters get through.
How Are AI Bots Getting Smarter?
Thales’ 2026 Bad Bot Report says bots made up 53% of all observed web traffic in 2025. Bad bots made up 40% of total internet traffic, and good bots, such as search crawlers, made up 13%.
Thales found that 24% of attacks on sports platforms are advanced AI led bots. These systems can mimic real users and bypass older security checks, which makes a ticket queue look busier than it really is.
The report also says AI led bot attacks were 12.5 times higher in 2025 than in the year before. Daily blocked AI bot requests went from 2 million to a whole 25 million, showing how far automation has entered normal web traffic.
More from Artificial Intelligence
- How Can AI Help My Small Business Manage Calls More Efficiently?
- AI Has Broken B2B Outreach And The Startups Adapting Are Winning
- AI vs. 100,000 Humans: Who Actually Holds The Creative Edge In 2026?
- Have You Ever Looked Yourself Up On ChatGPT?
- What Does Anthropic’s Shutdown Mean For European Businesses?
- Executives Four Times More Confident About AI Risk Than The Teams Managing It
- Will We Start To See A Rise In AI Companies Going Public?
- ChatGPT Hits A Billion: Which Apps Have The Most Users In 2026?
The problem is that bots can also hide in plain sight with Thales saying 41% of bad bot traffic declared itself as Chrome in 2025, and 17% declared itself as Android Browser. To a sports site, that can look like ordinary matchday browsing.
Tim Chang, Global Vice President and General Manager, Application Security at Thales, said, “We’re reaching a point where genuine sports fans are becoming the minority on some websites in the run up to major sporting events. Peak demand creates huge opportunities for automated abuse, with fans increasingly competing in digital queues flooded by malicious bots designed to buy faster and overwhelm platforms at scale.”
What Does This Mean For Fans And Sports Sites?
Thales said sports platforms face ticketing abuse, resale activity, scalping, fake account creation, account takeovers, streaming problems and slow platforms caused by automated traffic surges. All of this can turn one match sale into hours of clean up for security teams and customer service staff.
Also, Thales’ report says 27% of bot attacks in 2025 targeted API endpoints, the systems behind search, booking, payment and login tools. Bots can bypass the visible website and talk straight to the machinery that runs the sale.
For fans, the pages slow down, carts empty, logins fail and seats disappear as a way to kick them out of those queues. A supporter can do everything right and lose out to software that never needs a tea break or a bank app code – plus it works really fast.
It’s worse because a fan account can hold payment details, loyalty status, tickets, personal data and resale access. Thales says account takeover was one of the most persistent forms of automated abuse in 2025, and login workflows were a prime target.
Chang said, “As malicious automation becomes harder to distinguish from genuine users, organisations need to focus on understanding behaviour in real time. Behavioural analysis, real-time traffic monitoring and AI-driven threat detection to identify malicious activity is becoming critical to protecting the digital fan experience.”
The World Cup has always produced demand but this time, sports websites have to go through having to separate or decipher fans from bots in the queue. That task now decides who gets in or out and how much trust supporters keep in digital ticketing.
