Put another way: More than 94 percent of the 100,000 domains included in the report experienced at least one bot attack over the 90-day period in Imperva’s study.

Websites that are less popular with humans—as measured by traffic—tended to attract more visits from bots. “Simply put,” Zeifman wrote, “good bots will crawl your website and bad bots will try to hack it regardless of how popular it is with the human folk. They will even keep visiting a domain in absence of all human traffic.”

Though bots are interested in websites even when humans are not, bot activity tends to mirror human behavior online. For instance, the most active helper-bot online is what’s known as a “feed fetcher,” and it’s the kind of bot that helps refresh a person’s Facebook feed on the site’s mobile app. Facebook’s feed fetcher, by itself, accounted for 4.4 percent of all website traffic, according to the report—which is perhaps stunning, but not altogether surprising. Facebook is a behemoth, and its bot traffic illustrates as much.

Overall, Feed fetchers accounted for more than 12 percent of web traffic last year. Search engine bots, commercial data-extracting spiders, and website monitoring bots are among the other helpful bots you’re likely to encounter online. (That is, if you consider the collection of your personal data for advertising purposes to be helpful.)

Data-grabbing bots do their work invisibly, while other bots are easier to spot. In fact, bots and people bump into one another often. Spambots show up in comment sections and Twitter bots clog people’s timelines with everything from marketing, to political campaigning, to social activism, to utter nonsense. These sorts of bots aren’t always pleasant, but they aren’t outright dangerous.

For the real villains, we turn to impersonator bots used for DDoS attacks. They accounted for about 24 percent of overall web traffic last year. Top offenders in this category included Nitol malware, a bot called Cyclone meant to mimic Google’s good search-ranking bots, and Mirai malware—a virus that caused mass internet disruptions in the United States in October.

Other bad bots to contend with include unauthorized-data-scrapers, spambots, and scavengers seeking security vulnerabilities to exploit. Together, they made up about 5 percent of web traffic.

And even though the internet is already mostly bots, we’re only just beginning to see the Bot Age take shape. According to the market-research firm CB Insights, more than a dozen venture-capital-backed bot startups raised their first round of funding last year.

We want to hear what you think about this article. Submit a letter to the editor or write to letters@theatlantic.com.