AI, DDoS, and the Internet in 2025 | Cloudflare Radar Year in Review

Hello everyone and welcome to this week in net is the December 19th 2025 edition. This week we're going to talk about Calfller radar year and review and there's a lot to unpack. The Coffler radar 2025 year review shines a light on the internet's patterns and trends as observed through Calfller's global network. Uh I'm your host Rome based in Lisbon, Portugal and with me I have as usual for our year in review David Bellson. Hello David. How are you? How are you? Glad to be back. Welcome back. Actually this year we already you already come came back after your review. Yeah, you do with outage related, Portugal related, actually big outages in Portugal and Spain and also the the disruptions summary that you usually do every quarter. For those who don't know, tell us where are you based? I am in Andover, Mass, a little bit north of Boston. Exactly. So, year in review, it's uh the sixth uh year in review that we do, right? Yep. Yep. Yeah. The first couple were during COVID and they looked at um a lot of where traffic was shifting around sort of London and San Francisco and kind of looking at people potentially leaving the cities and how that impacted internet traffic. And then in 2022 on we started adding more more metrics uh and have evolved it now to to this year of course and one of the things that always surprised me working with the radar team and and doing these with you and others is the amount of things that Culer can see different metrics different data trends and how they are a proxy of what happens online really we the disruptions as you well know but also like uh new internet traffic roads between countries differ between countries starling perspectives more recently as we're going to discuss postquantum encryption so there's a lot to to see and observe and check iOS where is iOS iPhones operating system more prevalent in some countries usually the rich ones so there are so many things around it's quite interesting to see the evolution throughout the year compared with other years can you give us a run through for this year. What was the main focus? What changed the most? Uh I think the biggest change we had was the introduction of a number of AI related metrics. So looking at um crawl, you know, largely focused on on crawling activity and how it varies between the bots, how what we call the crawl to refer ratio varies between the various platforms. Uh so that one looks at how much the these various AI platforms are crawling in comparison to how much traffic they're actually sending back to a website. What else do we have? Uh can't remember there's so many um the a lot of traffic craw you know and crawl purpose. Oh and the other piece we had was that we added this year was looking at the various AI crawlers in robots.ext files. So those are are files as you know that a site or an application owner can can place on their website and it basically tells specific crawlers you know either hey keep out entirely or you know stay out of this directory and that directory. So, so sometimes you'll you'll want to allow a given search or uh AI training crawler, maybe you get they get access to the main content on your site, but you don't want them accessing more um private information or not that you should have them on your website anyway. But, you know, there are various oftentimes directories and things like that that you just don't want them to uh to to index, which makes sense. And for those, it's also important to know that people can actually use robot.ext text. So it's a tool that is available although it's not by as it's it is currently um it's not like enforceable. Yeah that's always been the challenge. I mean I think you know it's it's got a 30ish year history. Uh, and I mean really it is what you know the the equivalent of hanging a sign on your your your your business's door that says hey you know keep out please you know [laughter] and then it's up to it's up to the person looking to go into the business to say oh okay yeah they don't want me here so I'll just go I'll go somewhere else so I'll just go away or whatever. Uh so yeah so I mean to that point you know it tells those boss and crawlers like hey we don't want you here. uh but there's really no it doesn't carry any weight of enforcement but but that's one of the things that that we've obviously announced over the last year are some services that will will also read the robots text and and take more action and if you say you know no Google bot or no open AAI crawler or no whatever uh we can look at that and say okay we're going to block uh these various crawlers from accessing the site and here it is the rubboext u perspective uh we actually have a perspective of how it started the and how it ended. So there's actually more bots blocked at the end of the year, right, than at the beginning. There's definitely I think, you know, more more site owners recognized, you know, hey, these are are potentially problematic uh and and took more steps over the course of the year to attempt to block them or to at least I suppose really work tell them to keep out. Exactly. So as you mentioned the crawler to referral ratio where people can see that entropic definitely uh has a better uh worse performance actually in this metric which means that the entropic has um 22,000 uh crawls per click they send to website owner for example yeah yeah it's much less uh with open AAI or even perplexity of course Google has 4.9 so much different Right. So this with Google, they're still largely functioning as a, you know, a historic search engine in that respect or historic search engine behavior, I should say. You know, so they're still doing uh, you know, as as we show in other graphs, uh, the most crawling, but when you go to Google, you also get uh, you know, in addition to the AI summaries, now you also get a list of links like you used to. Uh, so as a user, I am still able to go back and and click through and get to a source uh, source site. uh whereas some of the other AI platforms are just providing answers and they're not providing links back to uh where those answers were were derived from course and one of the things that uh it's quite clear is and we we discussed this in previous uh episodes is how for example claude if they don't have links inside like their chatbot to external sites there will be less referrals to them so they send less traffic to others so that uh that h influences uh these metrics in particular as well. And you were mentioning Google bot and how it drives um AI bots craw and crawling traffic which we should mention that Google bot usually is the it was like the first bot from Google initially uh for search uh only but now we know that it's also being used for other things than search so also for training. That's why we including this year Google bot with the others. Right. The multi-purpose bot in that respect. Exactly. uh and compared with the others has much more uh crawler traffic specifically here. The second one is GPT bot and then Bingbot. Um so also perspective here specifically on AI uh and this is the type of um type of uh crawling right training is number one. you know, probably no surprise there that the training crawling is still the vast majority of of the activity that we see uh you know, followed by search and then followed by user action where where the bots are going out in in response to some sort of user request and trying to gather content from a site. Um so that grew pretty significantly this year. Um but I think that's also a function of of more of that kind of uh more of that kind of functionality becoming available uh within the platforms of course and of course agents this is what we call a bit of agents people ask the the model to do something for them specifically it's like a specific request from the user it takes an action so it's a lot related to AI agents in a sense and that has been this is this is where you can ask the chatbot like you know what's the cheapest flights to Portugal and it would have to go out and make those requests to to airline sites or something like that. Um whereas uh you know and sort of you're looking for like more real-time data there, you know, as opposed to something that it can respond to. can provide an answer on rod that's that's based on historical data that it's it's it's crawled and trained on of course uh and we also have a workers AI model uh area regarding AI right generation being what are most do workers AI text generation is not a surprise being number one no no not at all also quite relevant I would say AI bot traffic share this is a new graph yeah this is a new graph that we we added first on your review and we actually just launched version of this on uh radar this week. Um so you know one of the interesting things here like we were just talking about uh so so in aggregate over the course of the year uh the AI bots that we track were responsible for about 4.2% of HTML requests. Um Google bot edged that out just a little bit. Uh Google bot in total was responsible for about four and a half%. Um so you know we looked at that graph earlier. You saw that the big Google bot line. Uh so even if you added up all the percentages uh of the the other AI bots we showed uh it still wouldn't it would still be just under um the the Google bot share. True. One of the things that surprised me here to be honest this is all AI bots not one all of them together you know it's the the dozen or so that we less less percentage uh than Google bot all together right but again that's the function of Google bot crawling for both uh trading and or excuse me um search indexing and trading exactly uh and it's it's dominant it's like the biggest search uh engine in the world so it's dominant for more than one reason uh in that in that regard actually while we'll at it and this is the next chart. This is actually a cool one that we had last year as well. Uh with a map we can definitely see in terms of iOS where iOS is more prevalent. You can see richer countries usually taking the the the crown in terms of iOS leaning more that direction. Yeah, of course. United States, Canada, across a lot of Asia, all of South America, basically all of Africa, uh most of Europe, uh Android is is, you know, we're seeing a higher share of traffic from Android. That's true. Actually, in is is most countries really most countries. Uh it's mostly Australia, Japan, and north of Europe and north of America that are driving more in terms of iOS. uh right I remember seeing something related specifically to uh richer countries and iOS usage so iPhone is is expensive so there call that out in one of the past years of review where uh you if we looked at the the um the GDP yeah I think the higher GDP countries uh or or the higher like per capita income countries lean more towards uh more towards the Apple devices of course while we're add it. Let's start in the intro of the year review. So, this is the intro of the year review with uh some boxes with percentages for people to explore here. Of course, it mentions the blog post that you wrote and I wrote, the overview one, but also the popular internet services one. And one of the things that I think we should mention is the amount of things people can do with this. It's not like the scrolling and looking here on the left for checking for the the different metrics that we have. And as you can see, right, we've got about almost 30 metrics. I'm sure I counted. Yeah. From the the the ones on the bottom, malicious email, stop email threads. Fun fact, do Christmas was the TLD that was most abused. There's like security, DDoS attacks, progression, there's the outages, internet quality. There's so many things to to explore and people can definitely explore using the microite. But one of the things I want to highlight is that you can also add the compare with 2024 perspective. So that will give you the worldwide perspective. This year we also have a languages actually I think we also had last year correct me if I'm wrong. World languages are new this year which is new. So this is perfect. We have also in Portuguese. Yeah. Last year we had the year of a year and between country comparisons and then this year we've added um the language, the translations. We've also added the uh the sharing uh this year as well. Exactly. This that's also a good element to highlight the sharing. People can download the image and share the trends that they're seeing. That's also cool. But I I would say really cool as well is the going by country. Something that we have since uh a few years ago. But uh all of these metrics at least most of them most of the metrics we have on the by country perspective right and like with the internet growth stat there you can tell when the the power outage was in Portugal it's quite evident yeah April April in April exactly that's a cool one and also Spain uh had the same outage the same actually if you compare it to Spain you should see the same dip true and that's another thing that we can actually do and why not use that example makes perfect sense the Spain progression here as well yeah Spain also dropped. Uh you can also see the how uh during the summer internet traffic behaves. For example, in Spain it drops more than in Portugal, but usually northern hemisphere drops during the summer because people go on vacation. Um and and peaks usually during um Cyber Monday, Black Friday, like the end of the year that usually there's a a peak there is quite common uh and quite interesting as well I would say. Um but there's a lot to explore and internet services in another one. For example, this year we added uh not only the overall perspective to internet services but also generative AI for example in portal chant GPD is number one perplex number two GitHub copilot number three. Yeah there there's many things to explore in terms of micro site for sure and I think that's a a very cool one to to show off. People can go there radar.fair.comyear- software.com/year-in- review and just browse through the countries and the metric they they want to see and from these metrics we didn't spoke still about space X but that's a popular one usually the growth of SpaceX have you been surprised on the growth every year we've been doing this I think for three years now every year this is like the third year always growing really should be um but I think the flip side is that we we see a lot of traffic when um you know for the countries that would have had Starlink service uh you know before the given year you know we still see the growth there and then we see generally very aggressive growth when a country uh when you start looking at enable services in a country so they're they're really good about posting on X they'll say hey you know Starlink service is now active or now available in you know Portugal let's say or whatever they uh generally within a couple of days uh we'll see traffic just just absolutely hockey stick up. Um, and uh, you know, so I I think there's definitely a lot of pent-up demand still uh, for Starling for Starlink services. Um, and I think that uh, you know, there's Amazon Leo, which is, you know, they're finally I think getting to the point where they'll get their their constellation uh, in orbit and and start offering services. And there's um, UTLAT one web in in Europe and then a Chinese similar Chinese offering. So, you know, maybe we'll start to see more traffic from these other uh network providers in the future, but I think right now Starlink definitely has, you know, a lock on um this type of service. True. And for those hearing this in the podcast format, Starling grew twice, two times uh over two times growth during this year. It was higher last year. Uh pretty consistent pattern throughout the year as well. So pretty, you know, pretty straight line almost. True. And you you can see that there's a definitely a growth pattern uh even if it's uh it's less than last year for example and Armenia I think was one of the 20 countries that the Starlink was added. Yep. So if you scroll down a little bit more you can see it basically starts you know traffic starts there what is that probably Aprilish Mayish other things that we usually have and this is also I think the postm is is definitely worth crawling calling crawling uh calling out this is something a metric you know it's a key metric that I think we we really been focused on a lot at uh Cloudflare you know we we've been tracking now for for almost two years u since it really began to be integrated into the the leading browsers um you know What we're seeing drive a lot of the growth is the um the various browsers uh setting postquantum encryption basically as a default you know so we're using TLS13 uh that that the PQ uh encryption is supported by default um so you know we saw those initial you can see the the growth there in 2024 and the dotted line uh in April that's probably when I think Chrome probably turned it on which so you can see so so that the growth there probably uh maps to more people um adopting the latest version of Chrome. Uh and then you know this year it's gradually grown. I think Firefox you know gradually uh made it the default and then that bump uh in september time frame is when the Apple uh iOS the Apple OS updates uh enabled PQ by default. So we saw, you know, for for I think we're up to about probably over 25% of the traffic we see from iOS devices right now or or yeah iOS devices as PQ. Uh but it basically drove it to uh more than half uh of the the TL the human generated TLS 1.3 traffic we see uh at this point is is using post collective encryption. It's it's quite amazing to see the expansion since last year was around 30% and even lower initially and then it uh this year 30% around 30% when the year started and more than half now at the end of the year right for those who don't know we we done a few episodes about postquantum cryptography in the past but it's quite important when quantum computers come around they will break encryption as we know it and this postquantum recption makes sure that that encryption is not broke. So that means our data currently will be secure if it's postquantum ready. Um so it's all about security and privacy, right? And remember that this is looking at postquantum encryption between an end users client and and Cloudflare. Uh one of the things we're we're working with internal teams on is bringing a perspective to uh post collective encryption between Cloudflare and the customer origin. Um so you know recognize you know so so I think something that that customers need to remember is that you know we're protecting the data that we're sending to uh an end user you know if possible here with with postquantum um but they really should be implementing on the origin side so that we can use that you know we can connect we can we can secure that cloudflare to origin connection with postquantum as well. Yeah makes sense makes sense. uh another topic do you want to to mention here David uh in terms of any went through AI I mean internet outages obviously that's where you and I both uh you know spend a non-trivial amount of time you know we saw about 174 major outages uh this year so as we talk about the blog post we've published on this uh that's certainly not an exhaustive count uh there are others that that we didn't cover but but this year I think it was almost half of them were um driven by uh government shutdowns uh or government directed shutdowns I should say government shutdowns happen in the US that's something separate um but you know seeing that's the vast majority of those and a lot of that is the individual shutdowns in Iraq and Syria uh and other countries like that um designed to prevent cheating on exams uh you know we saw government shut government directed shutdowns in a few other countries around um uh protests uh so trying to prevent the internet either either trying to prevent, you know, news and and video about the protests from getting out or trying to to prevent uh citizens from protesters from organizing. Um and then you know power outages are always obvious an issue uh where we'll see you know internet traffic drop from a given country uh when there's a power power cut uh and then cable cuts uh you know both uh domestic terrestrial uh as well as submarine uh always have issues there makes sense and uh this uh this timeline also gives the people the possibility to check definitely in the summer especially because of the government directed ones that's the exam Right. The examp Iraq and Syria are are where those clusters are. Yeah. And it's really cool to explore uh during the year when those were more concentrated. You can definitely see there's a trend there anything different from this year uh regarding uh the outages. David. Um, so I think the the uh I don't remember exactly which which were which, but I think there's always power outages and cables, but uh Nathan something due to power outages and cable cuts. One of them had like dropped by half and one of them like doubled uh year-over-year. So you know but other than that I think you know there are largely the the usual suspects you know I think it's anything that's going to cause anything that damages infrastructure whether it's it's you know servers themselves like one of the the ones we have listed as fire there was a fire at a data center uh at a major uh provider in Egypt um so that obviously damaged you know physical infrastructure there uh which took them some time to get back um you know weather so so things like hurricanes and typhoons and things like that will will damage infrastructure uh causing internet outages um you know say with natural disasters like earthquakes. Where should we go next David? Oh let's see. Um so how about the global speed test activity? Um so that's another new um new metric we added this year. So you know Cloudflare has the the Cloudflare speed test uh it's speed.cloudflare.com. Uh so users can go there and you know you click the button and it uh runs a pretty compre pretty comprehensive speed test. uh looking at um you know uh upload speed, download speed uh and then idle and and loaded latency. Uh you know we seen millions of these tests but we were curious you know where are they coming from and you know did anything change uh in in an interesting way over the course of the year. So what we did is we took all the speed tests that were uh were taken over the course of 2025 uh and plotted them uh by generally by general location uh and then animated that over the course of the year. So you can see you know what uh what kind of activity um happened and where you know where are people most interested in in getting a sense of the quality of their connection. Um so one of the things we saw of course was as we call out there you know London was one of the hot spots uh Los Angeles was another one uh and then there were a couple of hot spots also in the AP pack region we saw as well on calling in in Japan. That's interesting. Uh and on on that note, we also have the internet quality always a popular one as well with the peninsula with Europe and Iberian Peninsula being on top with Portugal and and Spain there for download speed but also upload speed. Yeah. I mean it was so one of the interesting things that Spain um has a uh I guess we used to call it a national broadband plan when I started you know dealing with this stuff you know 17 18 years ago um where they they basically Spain basically said we we talk about a little bit more in the blog post uh that you know they the government said you know to the providers you know you will get you will make broad uh gigabit connectivity available basically to everybody uh you know by 2025. Um, so not to say that everybody has adopted that. Not to say that, uh, you know, it's necessarily affordable. Uh, I don't actually don't know what the costs are, but you know, I think clearly the work that's been done to improve, uh, the the connectivity quality in Spain is is showing up, you know, here to some extent. That makes sense. Uh, also the latency with Iceland there being the best. Yep. Yeah. So latency is important, too. I think that's one of the things uh that some of the folks in the industry talk about where you know especially some of the folks I know from u some of the speed testing services uh is that they they they feel almost bad uh that they convinced everybody over the years uh that connection quality is really all about download speed. you know, that's really important, but it's it's not the end- all beall for more of the interactive real-time experiences like, you know, watching a video or or even recording this uh online gaming um things like that. Latency and having low latency is really important. So, you can have uh a high, you know, really high download speed, but if you've got high latency on that, it's you're the connection quality ultimately becomes terrible. uh whereas a a lower connect lower speed connection with much lower latency uh can actually give you a better experience. Makes sense. Uh there's also I think a new one regarding DDoS attacks, right? Yes. The hyperboltric DOS attack size progression. Yeah. So a week or two ago we we published the the Q3 uh DOS report uh and that had called out a 29 it was 29.7 terabit attack uh which you know is just insanely big. Uh and then what we saw we we sort of pulled the the data through the end of November uh was that there was actually another set of attacks in November uh that drove that peak up to over 31 terabytes. I think it's 31.4 terabytes. I think we do the rounding there. I'm not sure. It is. It is. But what's really interesting too to see is you know we'd hit a peak and then sort of like the peak would carry for a few months and then there'd be another round of attacks and we'd hit another peak and then sort of in in the September time frame there was a big flurry of attacks. And what we unfortunately didn't show here is the the scatter plot of of the attack activity. And you can definitely see the attack activity is is is heavily concentrated uh during those time frames where we saw the peaks occur where we saw the you know the growth uh and then it's just very very concentrated like the September to November September to December time frame. True. Which lots of lots of attacks happening and the volume is just crazy the volumes the record volumes these are record volume. Yeah. Of of attacks for sure. Uh also uh one that usually brings some attention uh website technologies and sometimes and I I was seeing someone mentioning the WordPress being on top here which was interesting recently. Yep. And that's something where there have been stats across the industry for I don't know several years that talk about just the large um the large share the the the big share of sites that run on WordPress. Uh and and I think our our stats, you know, ver not I would say verify, but they they align with those other observations as well. True. And this is using a very cool radar tool called URL scanner to analyze websites uh and the top 5,000 domains to identify the most popular technologies here. Uh right we we already mentioned the blog but this is the blog that you wrote about that gives the overview of the year in many of these trends that we've been discussing trying to pull out key findings you know what are some interesting bits that we saw across each of these metrics uh and then drilling down a little bit into those uh key findings and some other you know other interesting observations uh within the the body of the blog post itself. Exactly. There's a lot to explore in the blog and in the micro side as we discussed. Uh we also have the internet services blog that I know a bit about. Uh why not actually starting there with the the microite specifically because the microite has that section specifically. One of the things that I would say was surprising this year was first how meta still uh rules uh social media but Instagram has been actually increasing uh in the overall in the global perspective while for example X has been decreasing uh and YouTube also performing really well with Tik Tok dropping in terms of the overall. The other thing that was really surprising this year was how Google Gemini uh and Perplexing Claude are now uh coming after Chat GBT as number one. Uh and and Gemini and we have this in in the the blog specifically uh Gemini ended the year right right at the end of the year was uh this is not the blog uh was right at at the end of the year uh number coming up as number uh uh second in generative AI uh trends. Uh so that was also a cool perspective here. There's a lot to explore in terms of e-commerce studio streaming. Um but uh Gemini being ending the year as second was definitely an interesting one. And also Deepseek in January was uh as high as number three. Then it dropped. So well that I mean that made a huge splash when it came out. Things that I didn't know too much about like Quai which is the Chinese short video app. uh really popular in Latin America and also Southeast Asia. I didn't know about that and I knew I learned about that writing this blog post and checking the trends. Also really interesting to to see that it's not only the players that most people know in some countries that are performing well, others are performing well as well. Uh Roblox ruling gaming was not a big surprise, right? Yeah. Oh, there's a lot to unpack in the blog. We try to show specific metrics and what happened at during the year in some of those services. May that be for example we have a news area regarding like the Iran Israel war and what happened to new signs at the time peing in our ranking there. There's a lot to unpack also the Black Friday uh momentum uh for several apps like Shopee and Tamu really. Is there anything in your anything in your research your findings that surprised you about the What's that? Can you not hear me? Well, David, we it's already long our our segment. What would be the main thing that you think people should take from this year caller your interview? I think the internet continues to grow and evolve. I think we we see that certainly through all of the metrics that we're collecting that we're analyzing. I think you know so so recognizing that that even though it's such a part of our daily lives it hasn't finished growing yet. I think the other things to take away would be just the importance of resilience. uh you know seeing all the different sorts of internet outages that are out there and you know if you're a business owner if you're an application owner making sure that you know you've got plans for if your upstream providers have issues and I think the other uh pieces from the security perspective is just you know so many different types of attacks and they're just getting bigger and more widespread uh you know making sure that you have as again as a business side application owner you know that you're protect you're taking the steps to to protect your your assets makes sense and because 2020 26 is just around the corner. Do you have like any predictions thinking of what's coming? I know it's really difficult to do, but I would love to have an internet disruption section next year that is short and boring. I don't anticipate that's going to happen, unfortunately. Uh I think we'll have, you know, I think the the the AI metrics will continue to evolve as that industry just just continues to evolve at a rapid pace. You know, we'll see if if Google continues to continue to to crawl at the volume it does. it has been uh you know we'll see if any of the competitors pick up the pace we'll see I think it'll be it will be interesting to see if there's growth in in agent traffic you know one of the things we're also doing is looking at not only you know training and search and user action but also breaking out another category there for agents for for those uh bots or crawlers that are specifically identified as such so seeing you know are we going to see that kind of traffic growth occur as well uh yeah the eye perspective is always interesting for for sure things are changing so much seeing the evolution ution both of AI crawlers but also if Google bot there could be quite interesting to see also how the behavior can change potentially I'm curious curious on that for sure one of the internet services piece also I think we you know we've talked about elsewhere like the there's like the top couple the bottom couple were were pretty static but then in the middle of the top 10 there was some movement so we'll see does that movement change does anybody you know does do Google and Facebook eventually get unseated from the top couple by uh an AI tool or by a social media tool or something like that. So you know whereas that list kind of hit a stasis and to be honest the generative AI section or category is one of the most interesting ones for internet services. Curious to see how Gemini Gemini continues to perform against the chatb. Yeah, it's been so dynamic over the last couple years and if we'll have a new leader that will be so quite something if that happens. a lot to unpack for what's coming in terms of 2026. Also, DOS I don't think will start not become a thing unfortunately. Yeah. I'm hoping we don't have to extend that graph to like 50 or 60 terabytes next year. True. True. Heading, you know, we never know. One of the things that we don't have in the report, but we had many blog posts uh during the year for example is how traditional news sites are continuing to lose traffic especially refer with referrals from Google for example. So that means less traffic, it's money for them in terms of how they can add value. You'll see that the business model for the web change. Yeah. So let's see how that also performs and and changes something there changes. Interesting times for sure, David. Absolutely. Always. This was great. Thank you. And let's see how how 2026 brings us. Looking forward to it. And that's a wrap. And that's a wrap.