Radar Bulletin: 2023 Year in Review

Good morning. Welcome to Cloudflare TV. My name is David Belson, Head of Data Insight at Cloudflare and leader of the Radar team. And I'm joined this morning by my colleague João Tomé. And we wanted to take some time to go over the 2023 Cloudflare Radar year in review. This is the fourth annual year in review that we published. I think they're getting better each year. And yeah, let's have at it. I'll share the screen, share the post, and we can begin to go through it. So good morning, João. Good morning. Hello, everyone. Good afternoon there, I guess. Exactly. In Lisbon time, where I am at, it's afternoon. And those who will be seeing this not in a live setting could be anytime, really. It's the marvels of the Internet that we will discuss. I was going to say, we could talk all about it. Yes. Yeah. So this is, I think, the culmination of several months worth of work. Excited to have it out there. I think we've gotten some good, looking at the stats this morning, some good viewership on it, some good media pickup, which is really exciting. I think it's really interesting every year as we go through this, figuring out what metrics we want to show. And then as we figure that out, running the numbers, analyzing the data, and seeing what stands out. What are those interesting things we find? What are those anomalies that we find? Which, of course, happens when you're dealing with large data sets. So yeah. But I think we started out this year, I suppose, with a set of key findings across the various topics. This year, we covered traffic insights and trends, we covered connectivity and speed, and we covered security. So where should we start? To be honest, I think the first layer of approach that we had in all the years that you're in review for Cloudflare Radar is done, is the traffic road. How did traffic change the patterns over the year? There's a lot to be said there in terms of what we show. Yeah, absolutely. And I think this year, we saw traffic grow about 25%, which was in line with last year. I'm excited that we were able to actually get the comparisons in there. I think it's really interesting to make sure that we're providing our users, our viewers, with the ability to do those comparisons. Absolutely. You should show the microsite where that's present. Oh, yep. That would probably be helpful also. Anyone can go to radar.Cloudflare.com. Yeah, radar.Cloudflare.com. Let's go just to your review. Yep. Exactly. And one of the interesting things I think we saw is we could have a number of interesting things within the microsite this year or within the traffic comparisons. Obviously, looking at a global perspective, but also looking at a country perspective. And one of the things that we called out within the blog was that these comparisons now begin to allow us to see things that are impacting Internet connectivity, Internet traffic in various countries. So if I remember correctly, Indonesia was one of the countries that we highlighted. And you can see, I believe here, this year, it was in late April. Last year, it was in early May. And I believe, let's double check. Ramadan, right? Ramadan. Yeah, it was the end of Ramadan. I don't want to screw up my explanation. Yep, there we go. It was, right, the celebration of Eid al-Fitr, the festival marking the end of the fast of Ramadan. So you can see that within the graphs. We also were able to see- Try Morocco. Morocco? Yeah, Morocco. It will show you several days, not only a few days, several days of the Ramadan there. Here was the end of Ramadan, both years. Exactly. Ramadan was March and April. So you could see over the two months. Yeah, the large drop there. Exactly. And Morocco, you will see also in September, that big drop in September, it's the earthquake in Morocco. So you could see the earthquake impact there. And that was, I was just going to get to something similar, like in Guam, where they were impacted by a typhoon in May and June. So we saw this absolutely massive drop in traffic as the typhoon made landfall and did damage. And it really took them like three months to see traffic get back up to normal and really begin growing again. So really, very interesting to see the impact of real world events on Internet traffic, whether it's a natural disaster of some sort or whether it's a holiday. But it really just gives a sense of how much we use the Internet in that respect. True. In most countries in Europe and also in the US, Canada, you will also see Easter. I think we probably also see a little bit of a summer vacation, Christmas break, dropping traffic as well, which I guess talks to maybe better traffic that college students generate. True, true. It's quite interesting to see different changes. And there's a microsite for people to explore different countries, the worldwide perspective. Yep, absolutely. And also outages, right? A lot of outages. Yep. Yeah. So like Guam here, I believe Mauritania was where there was two multi -day shutdowns. So these were government -directed shutdowns that resulted in these massive drops in traffic there. You can see that it did not follow the same sort of growth trend as it did last year. By the way, another interesting trend that is, where does traffic peak? In most countries in Europe, northern hemisphere actually, traffic peaks during late November and then drops during December. And because this year we have the 2022 line, anyone can see the drop in December. Yep. That was great. And so that's a good point. Even we saw that last year here in the US where it peaked basically December 1st, so late November effectively, and then just dropped throughout the rest of the month. And then really this was Christmas at its lowest point here, and then sort of started to slowly pick back up. And it then drops again on January the 1st, but that's the zero there. So it's- Right. That's sort of zero point. Yep. Which are next? Possibly iOS. Why not iOS versus Android? Seems a good perspective there. This is a new perspective this year that we have on radar now, but also in the year in review microsite. And it gives us a different perspective in terms of the different countries, where is iOS and Android more dominant in a sense? Yeah. We added this to radar over the last couple of months. And then in looking at the data for this particular metric, it was really interesting to see the distribution at a country level. And as we called out in the post, one of the things we noticed certainly was that iOS usage seemed to be higher in countries with sort of a higher standard of living, more disposal income effectively. Whereas the availability of lower cost, potentially lower powered, but lower cost Android phones, I think made it the iOS of choice, the device of choice in a lot of countries where the economy is not really quite as strong. That's true. Northern Europe, for example, is one of those cases. US, Canada also. Strong iOS struggles. Yeah. But like in Africa and many parts of Asia pack, they're definitely lean more towards Android usage. True. In some cases, it's more than 90%. Yeah. It was very interesting to see that. And over there, we have something that made the news, the SpaceX perspective too. Yeah. So I was really surprised, I guess a little surprised and a little not surprised at how much coverage the SpaceX data got. But I suppose it's still really something that's seen as new and interesting. Basically, we saw traffic from SpaceX effectively triple over the course of the year. It'll be interesting to see if they continue that growth, if they're able to really bring a significant number of new subscribers on board. Amazon Kuiper is launching and then the OneWeb effort is also launching. So if those gain, I don't know how much traction those will gain over the course of 2024 to the extent that it'll maybe dampen Starlink's growth, but we'll have to see. But I think one of the things we've definitely seen is that when the service becomes available, the usage picks up rapidly. You can see Brazil is an example here. The service became available in effectively late 2022, grew gradually over the course of the back half of the year, but then really just accelerated in 2023 and really into a little more gradually the first half of the year, but then really took off the back half of the year. So they saw effectively about 17x growth. And Starlink, or in this case, exactly Starlink, it's a very specific service where sometimes it's only available, Brazil is a very big country, and it's only available in a region, in an area of the country, and then it expands. So that was the case in Brazil. They only launched initially in one region, I believe, and then they expanded. But the growth is quite amazing to see. Was that the case last year? Actually, in Ukraine, we reported this last year, the importance of Starlink in Ukraine at the time, and it continues to be this year. So the growth continues to be there. Right. Yep. So you can see it definitely started to grow last year in Ukraine, just after the war began there. The blue line is ostensibly dampened a little bit because we are normalizing the graph to the max traffic value across both years. So obviously, there would be this peak in late August, and there's another peak here in October. But yeah, to your point, it's really just because they're turning the service on in a given country doesn't mean it's available across the country. And then, of course, you still have the issue of being able to get the dishes into the country, people being able to afford them, and so on. So adoption is more gradual. Exactly. And there's a lot of countries now with Starlink, which is interesting too. Yeah, they're definitely broadening their footprint. Exactly. Where should we go next? Let's go... Let's talk about this for one minute. So this is a new perspective, right? Yep, this is a new perspective, an interesting visualization. And the intent here was just to provide a 100,000-foot view on where Cloudflare is seeing traffic from across the IPv4 Internet, and to break it out by blocks of addresses. So it takes a little while to render just because there's so much data behind it. But the idea here is to use something called a Hilbert curve, sort of a unique type of visualization to plot where we're seeing traffic coming from, and to shade that in such a way that it gives you a little bit of a heat map effect. So what we're doing ultimately is breaking it out by registry. So who ultimately owns those blocks of addresses that we're seeing the traffic from? And then more specifically, we can break it up by ASN. Yeah, so breaking it up by country and ASN. So we can zoom in. So as we zoom in, you can begin to see more about the ownership of the blocks. In some cases, you're seeing a lot of US military ownership still, like DISA and DSI. You're seeing some reserves. So in this case, this is the 10 block. So if you're running an internal private network, a lot of times you'll use addresses from 10 slash 8. But then interestingly, you've got a whole slash 8 that is owned by Daimler, the automobile company. And so if we zoom in there, one of the interesting things we'll see is that we are seeing traffic from it, but not much of it seems to be generating traffic. We're seeing a little bit of traffic from this little block here. And then if we scroll down a little bit, we'll see more traffic from there. So it looks like maybe their IT department maybe has two blocks of addresses that they use to gateway traffic to the rest of the Internet. Sure. And you can click on your own IP, zoom in on your own IP? You can. Because I'm on a warp at the moment, I have a v6 address. If I was connected directly to my Verizon Fios connection, in theory, I would have had an IPv6 address, but they seem to have, for some reason, turned that off recently. So I would have been able to zoom into the block around my IP address if I'm on IPv4. But it's a really cool zoom too. It gives you a sense of your neighborhood. Where are you at in terms of IP addresses there? Yep. Yep. I think going through just a few of the others, we looked at outages. Obviously, we won't spend much time on this here because we've got this covered on the outage center. Continuing to, I think, endorse and evangelize for v6 adoption. I think this was an interesting overview, the Internet quality section, where we took the data that we had added to radar this year in terms of the Internet quality and the connection quality tests, and exposed that on the year in review at a sort of a yearly aggregation. That's a good perspective to have too. And on the radar page itself, we also have a world map of where is it better in terms of download speed, upload speed, latency. Yep. Which is effectively what we're showing on the global view here. But then if you look at a country, for instance, Iceland, we'll show the graphs here showing the distribution of upload and download speeds and idle and loaded latency. And then just to jump into security for a bit, I think one of the things before we talk about the top Internet services, which is your area of expertise, just highlighting a couple of things here. One is bot traffic sources. So I think this is a really cool visualization and shows... We were able to break it out and say, okay, looking at where bot traffic is coming from, and again, bot traffic may be malicious or maybe things like search engine spiders. We're seeing most of it, we're seeing a third of it from the US. If we look at the top 10 countries, it accounts for about two thirds of the bot traffic. And if we break it out by autonomous system, by network, we see Amazon here, this Amazon autonomous system is almost 8%. This one's almost 4%. So they're really the top bot traffic source. You've got a couple of Google ASNs across the top here. And then you've got others, including like DigitalOcean and Hetzner, Azure, OVH. So you're seeing a lot of the bot traffic unsurprisingly coming from cloud platforms. Which makes sense. Yep. We took a year long view of commonly exploited vulnerabilities. So I think we're still seeing log4j as being actively probed and actively targeted. And there was actually another report that I saw yesterday that actually dug into some of the log4j attack activity. It was a third party, but they're again still seeing it as well. That was a major vulnerability that appeared in December last year. You were saying? Yeah, log4j, yeah. It was actually 2021. Was it? I remember it was, I believe it happened right before I joined. So yeah, so it's been hanging out now for about two years. Well, my Decembers are finished. And we're still really actively targeted. Looking at post -quantum encryption, so this is going to be really important. I think we can certainly say more about this in the future, but from a security perspective, I think this is going to grow to be just increasingly, increasingly important going forward, especially as more of the browser vendors add support for it in their browsers. True. For those who don't know, post-quantum security there is related to the fact that quantum computers are coming. There are some already there, but there's the potential of those quantum computers break the cryptography there is around today. So for the data to be secured in the future, this post-quantum cryptography should be in place to keep the data safe, the data of today safe in terms of the computers in the future. Thank you. That is actually, yeah, it's kind of helpful to provide that context. And then just wrapping up before we go to the top 100 services, bringing again some area one email security insights here. So a little bit under 3% of the emails that we processed are malicious in some way. They've got something within them that we say, hey, this is potentially bad. And then in looking at what's in them, those threat categories for the malicious emails, one of the things that we saw was that more than 50% of them, this purple line here, actually makes it go away, shows the trend of emails we saw that had deceptive links in them. So you can see it, it's really stays generally about 50% for most of the year, drops a little bit towards the late third and early fourth quarter, but then it's coming back. So, yeah, so it's really interesting, and obviously, these two just always need to be vigilant in terms of just doing something as simple as reading your email. And then we also looked at routing security. This was something that also really hit the big time this year, especially with the USFCC, holding a hearing on it, Cloudflare had the opportunity to participate, but this is something we are tracking in terms of routing security. But having said that, I wanted to spend the last few minutes here as well, switching gears and talking about the popular Internet services. So I don't know if you want to look at the, do we want to talk through the tables here, or do you want to go to the blog post? Either way works, possibly. So here are the 10 categories that we have, and in this case, very specifically, we have the ranking of the full year. For example, this is very typical one, TikTok number four. One of the new things this year was that Twitter, there was not one day over the year that joined the top 10 on iCloud, on the overall perspective. But we have a new category in town, which is generative AI this year. And in this case, of course, OpenAI with no surprise is number one, but there was inclusions like BARD over the year, last part of the year was like fourth, five, but because there was no BARD in half of this year, mostly, it's positioned here on number eight. Do you think that they would have ranked higher had they launched, say, late last year, like ChatGPT did, or they launched in January? Do you think they would have been higher in the list? They would. If you go to the blog post, we show the evolution of BARD and others over the year. So the blog post has a bunch of trends related to the evolution of the year of some of the services. And you could see that BARD goes - BARD, is that purplish? Purplish, yeah. It goes to the fifth position in November. I see, okay, yeah, right there, ends the year. Exactly. So it goes, there's a growth tendency. And of course, BARD was launched from Google, was launched in terms of Europe, at least, so more worldwide perspective in July, if I'm not mistaken. So that was when that service in specific started to build up. And POE also had a major release during the year. Yeah, it looks like it kind of entered in around April-ish. Exactly. So this is a new category that we added this year. And all of these rankings mostly come from the domains area that we have on Raider. That domains area is more a raw list where there's infrastructure domains. There's those domains that people don't know what they mean, like G-Static, things like that. They don't know what they mean. What we try to do here is make it, we call it Internet services because it's mostly websites that humans use. That's the main objective here. Right, right. And then the other thing we do here that's slightly different is aggregating the domains, right? So maybe less of an issue with some of these generative AI services since there may be singular domain focused, but like X and Twitter, for example, we've got twitter.com and t.co and x.com. The biggest example actually is TikTok. TikTok, because they have a lot of videos, they use a lot of tiktokv.com to generate those videos or tiktokcdn.com. So we're aggregating some of those into a one name service. Trying to capture all of the domains that are used to support a given service. Exactly. To be more accurate in that perspective. So there's a lot to explore here in different categories. I think the most surprising was not generative AI, to be honest, although Bard was appearing there. Most surprising for me was the e-commerce one where Temu, which is a new platform, a new e-commerce platform from, it's Boston based, but it's also Chinese investment based. And they launched in the US in September of 2022. And they're now very high in our list of most popular e-commerce services. That was a big surprise because we all know Shine, and Shine is a fast fashion brand that is also growing in our list, but Temu overpassed Shine during the year. So that was particularly interesting in that regard. And other metrics that we have go along the, I think, lost you, David, for a bit, but you're back. You're muted. I do not know what is going on with my computer today. That's the second time that Zoom has disappeared. My apologies. You were saying, you'll see, let me, now I can bring this back up. Oh, I need to share my screen again. Sorry. Hang on a second. Oh boy. Do you want me to share? Yes. Okay. So I'll just pick it up. Sorry. Thank you. So social media was also an interesting perspective because a lot of talk about Twitter during this year. One of the interesting perspectives was that X or Twitter was not in the top 10 of general services. So overall ranking this year. So it shows a tendency of drop. This chart shows it clearly, but it was not a single day in a top 10 position. And it was last year, several days of last year, Twitter was on the top 10. This year, that didn't happen. And also there's the Twitter alternatives perspective, Macedon, Treads, and others. Treads, of course, was launched in July from Instagram. And in this case, Treads appears in our list, top 500 list in July. Yep. Shoots up when it gets launched and then sort of drops. And that, I mean, I think that really also, that like trend line, I think, follows sort of the coverage that it got. Everybody was like, oh, super excited about it launching. And then sort of people realized that it might've been a little more limited or that their community wasn't on it. So they kind of walked away. But then I think over time, as they've enhanced it, I think more people seem to be maybe going back to it. True. Makes sense. And of course, Macedon actually is higher in our list, in the top 200, for example. And we also have some perspectives in terms of Blue Sky, not a very performant app in our perspective. Still very small though, too. I think they've got, I think what I saw, it was about 2 million users at the moment. So I think until they really open their floodgates. True. Even Threads, they are not in Europe at this moment. Oh, that's right. That's right. I think they're intended, they want to launch in Europe during this month. Let's see if that happens. I remember seeing the story about that. And through social, also here, it's dropping during the year. It peaked in August, but it's dropping in the last part of the year. So there's different perspectives here. I think the most interesting ones are out of the top three, where Facebook and TikTok and Instagram are definitely the number three, but the others show different perspectives. Like those who are more popular on weekends, actually social media usually is more popular on weekends. There's a few perspectives here. There's also this Be Real French social media app, also appearing high in our ranking, which is interesting in a sense. There's different perspectives in terms of data here. We also have some Black Friday perspectives, like a lot of these apps that we buy peaked during Black Friday. Right, which makes sense, I think. It certainly makes sense. We have about a minute left. Is there anything, there's one particular one that stood out there? In what area, in general? The bottom one, the overall. The overall one. There's actually one, Taylor Swift, appeared in our top 500 ranking for a day in August 10th, when a new album was launched. And also Beyoncé appeared when Beyoncé was on the news, because it's official site was on our ranking, because Financial Times reported that Sweden had a surge in inflation during a tour. Okay, and we're done. Thumbs up, Brad.