Nearly one in three visits to a website is from a computer up to no good according to a newly-published study.

The figures come from Incapsula, a website security firm. It gathered statistics from 90 days’ worth of visits to 20,000 sites belonging to its clients, with the relevant traffic including visits from every country in the world.

The company carried out a similar survey last year that found 51 percent of visits to websites came from some form of bot: a computer accessing the site itself rather than a human user intentionally visiting through their browser.

This year the balance has shifted further towards bots, which made up 61.5 percent of visits to the measured sites.

According to Incpasula, the total breakdown had 38.5 percent of visits coming from humans and 31 percent from what it classified as “good bots”. Most of this traffic was search engines crawling sites and increased activity of this type was a major reason for the change in the human-bot ratio. That increases the costs borne by site operators, though in theory this helps increase the accuracy of search engines and will increase the exposure of high-quality, relevant sites.

The remaining 30 percent of visits was made up of 5 percent being scrapers (computers effectively cutting and pasting content to reuse without permission), 4.5 percent being some form of automated hacking tool, 0.5 percent being automated spam such as computers leaving bogus comments on sites (something that has fallen significantly as a proportion of total traffic, if not necessarily in absolute terms), and 20.5 percent being “other impersonators.”

Incapsula believes much of this last category is made up of more sophisticated malware activity that poses as a search engine or a human user running a particular browser, in an attempt to bypass security measures on websites. It also points to a change in the specific tactics used by those carrying out DDoS attacks.