AI, DDoS, and the Internet in 2025 | Cloudflare Radar Year in Review

Hello everyone and welcome to This Week in NET. It's the December 19th, 2025 edition. This week we're going to talk about Cloudflare Radar Year in Review. And there's a lot to unpack. The Cloudflare Radar 2025 Year in Review shines a light on the Internet's patterns and trends as observed through Cloudflare's global network. I'm your host, João Tomé, based in Lisbon, Portugal. And with me, I have, as usual, for our Year in Review, David Belson. Hello, David. How are you? Good to be back. Welcome back. Actually, this year you already came back after Year in Review. A couple of times, but... Yeah. Which outage-related, Portugal-related... Actually, big outages in Portugal and Spain. And also the disruptions summary that you usually do every quarter. For those who don't know, tell us, where are you based? I am in Andover, Mass. A little bit north of Boston. Exactly. So, Year in Review, it's the sixth Year in Review that we do, right? Yep. The first couple were during COVID and they looked at a lot of where traffic was shifting around London and San Francisco and looking at people potentially leaving the cities and how that impacted Internet traffic. And then in 2022 on, we started adding more metrics and have evolved it now to this year. Of course. And one of the things that always surprised me working with the Radar team and doing these with you and others is the amount of things that Colfer can see, different metrics, different data trends, and how they are a proxy of what happens online, really. We see disruptions, as you well know, but also new Internet traffic routes between countries, differences between countries, Starlink perspectives. More recently, as we're going to discuss, post-quantum encryption. So, there's a lot to see and observe and check. iOS, where is iOS, iPhone's operating system more prevalent in some countries, usually the rich ones. So, there are so many things around. It's quite interesting to see the evolutions throughout the year compared with other years. Can you give us a run through for this year? What was the main focus? What changed the most? I think the biggest change we had was the introduction of a number of AI-related metrics. So, looking at, you know, largely focused on crawling activity and how it varies between the bots, how what we call the crawl-to-refer ratio varies between the various platforms. So, that one looks at how much these various AI platforms are crawling in comparison to how much traffic they're actually sending back to a website. What else do we have? Kendra Midler. There's so many. A lot of traffic, you know, in crawl purpose. Oh, and the other piece we had this year was looking at the presence of the various AI crawlers in robots.txt files. So, those are files, as you know, that a site or an application owner can place on their website and it basically tells specific crawlers, you know, either, Hey, keep out entirely or, you know, stay out of this directory and that directory. So, sometimes you'll want to allow a given search or AI training crawler. Maybe you get access to the main content on your site, but you don't want them accessing more private information or enough that you should have on your website anyway. But, you know, there are various, oftentimes, directories, things like that, that you just don't want them to index. Which makes sense. And for those, it's also important to know that people can actually use robots.txt. So, it's a tool that is available, although it's not by, as it is currently, it's not like enforceable. Yeah. So, it's always been a challenge. I mean, I think, you know, it's got a 30-ish year history. And I mean, really it is, you know, the equivalent of hanging a sign on your business's door that says, Hey, you know, keep out, please. And then it's up to the person looking to go into the business and say, Oh, okay. Yeah. They don't want me here. So, I'll just go. I'll go somewhere else. So, I'll just go away or whatever. So, yeah. So, I mean, to that point, you know, it tells the bots and crawlers like, Hey, we don't want you here. But there's really no, it doesn't carry any weight of enforcement. But that's one of the things that we've obviously announced over the last year are some services that will also read the robots.txt and take more action. And if you say, you know, no Googlebot or no OpenAI crawler or no whatever, we can look at that and say, Okay, we're going to block these various crawlers from accessing the site. And here it is, the robot.txt perspective. We actually have a perspective of how it started the year and how it ended. So, there's actually more bots blocked at the end of the year than at the beginning. I think, you know, more site owners recognize, you know, Hey, these are potentially problematic and took worse steps over the course of the year to attempt to block them, or at least, I suppose, tell them to keep out. Exactly. So, as you mentioned, the crawler to referral ratio, where people can see that Entropic definitely has a better, worse performance, actually, in this metric, which means that the Entropic has 22,000 crawls per click they send to website owner, for example. Yeah, yeah. It's much less with OpenAI or even perplexing. Of course, Google has 4.9, so much different. So, this... With Google, they're still largely functioning as a historic search engine in that respect, or historic search engine behavior, I should say. So, they're still doing, you know, as we show in other graphs, the most crawling. But when you go to Google, you also get, you know, in addition to the AI summaries, now you also get a list of links like you used to. So, as a user, I am still able to go back and click through and get to a source site, whereas some of the other AI platforms are just providing answers, and they're not providing links back to where those answers were derived from. And one of the things that it's quite clear is, and we discussed this in previous episodes, is how, for example, Cloud, if they don't have links inside like their chatbot to external sites, there will be less referrals to them. So, they send less traffic to others. So, that influences these metrics in particular as well. And you were mentioning Googlebot and how it drives AI bots and crawling traffic, which we should mention that Googlebot usually is the... It was like the first bot from Google initially for search only. But now we know that it's also being used for other things than search. So, also for training. That's why we are including this year Googlebot with the others. Right. The multipurpose bot in that respect. Exactly. And compared with the others has much more crawler traffic specifically here. The second one is GPTbot and then Bingbot. So, also perspective here specifically on AI. And this is the type of crawling, right? Right. So, probably no surprise there that the training crawling is still the vast majority of the activity that we see, followed by search and then followed by user action where the bots are going out in response to some sort of user request and trying to gather content from a site. So, that grew pretty significantly this year. But I think that's also a function of more of that kind of functionality becoming available within the platforms. Of course. And of course, agents, this is what we call a bit of agents. People ask the model to do something for them specifically. It's like a specific request from the user. It takes an action. So, it's a lot related to AI agents in a sense. Right. This is where you can ask the chatbot, like, what's the cheapest flights to Portugal? And it would have to go out and make those requests to airline sites or something like that. Whereas, you're looking for more real-time data there as opposed to something that it can respond to or can provide an answer on that's based on historical data that it's crawled and trained on. Of course. And we also have a worker's AI model area regarding AI. Right. Text generation being the most popular. What our customers are doing on worker's AI. Text generation is not the surprise being number one. No, no, not at all. Also quite relevant, I would say, AI bot traffic share. Yeah, this is a new graph that we added first on your review when we actually just launched a version of this on Radar this week. So, one of the interesting things here, like we were just talking about. So, in aggregate, over the course of the year, the AI bots that we tracked were responsible for about 4.2% of HTML requests. Googlebot edged that out just a little bit. Googlebot in total was responsible for about 4.5%. So, we looked at that graph earlier. You saw that the big Googlebot line. So, even if you added up all the percentages of the other AI bots we showed, it would still be just under the Googlebot share. True. One of the things that surprised me here, to be honest, this is all AI bots, not one. All of them put together. Right, right. It's the dozen or so that we- They have less percentage than Googlebot altogether. Right. But again, that's the function of Googlebot crawling for both search indexing and trading. Exactly. And it's dominant. It's like the biggest search engine in the world. So, it's dominant for more than one reason in that regard. Actually, while we're at it, and this is the next chart, this is actually a cool one that we had last year as well. With a map, we can definitely see, in terms of iOS, where iOS is more prevalent. You can see richer countries usually taking the crown in terms of iOS being more dominant. Leaning more in that direction. Yeah, of course. United States, Canada- Across a lot of Asia, all of South America, basically all of Africa, most of Europe. Android is seeing a higher share of traffic from Android. That's true. Actually, it's most countries, really most countries. It's mostly Australia, Japan, and north of Europe, and north of America that are driving more in terms of iOS. Right. I remember seeing something related specifically to richer countries and iOS usage. So, iPhone is expensive. So, there's a correlation there. We called that out in one of the past years review where if we looked at the- The GDP? The GDP, yeah. I think the higher GDP countries or the higher per capita income countries lean more towards the Apple devices. Of course. While we're at it, let's start in the intro of the review. So, this is the intro of the review with some boxes with percentages for people to explore here. Of course, it mentions the blog post that you wrote and I wrote, the overview one, but also the popular Internet services one. One of the things that I think we should mention is the amount of things people can do with this. It's not like the scrolling and looking here on the left for checking for the different metrics that we have. And as you can see- We've got about, I think, almost 30 metrics here, I counted. Yeah. From the ones on the bottom, malicious emails, email threats. Fun fact, .christmas was the TLD that was most abused. They're like security, DDoS attacks, progression. There's the outages, Internet quality. There's so many things to explore and people can definitely explore using the microsite. But one of the things I want to highlight is that you can also add the compare with 2024 perspective. So, that will give you the worldwide perspective. This year, we also have languages. Actually, I think we also had last year. Correct me if I'm wrong. No, languages are new this year. This is new. So, this is perfect. We have also in Portuguese and Spanish. Last year, we had the year over year and between country comparisons. Then this year, we've added the language translations. We've also added the sharing this year as well. Exactly. That's also a good element to highlight the sharing. People can download the image and share the trends that they're seeing. That's also cool. But I would say really cool as well is the going by country. Something that we have since a few years ago. But all of these metrics, at least most of them, most of the metrics we have on the by country perspective. Right. The Internet growth stopped there. You can tell when the power outage was in Portugal. It's quite evident. Yeah, April. Exactly. That's a cool one. And also, Spain had the same power outage. Actually, if you compare it to Spain, you should see the same difference. True. And that's another thing that we can actually do. And why not use that example? It makes perfect sense. The Spain progression here as well. Yeah, Spain also dropped. You can also see how during the summer, Internet traffic behaves. For example, in Spain, it drops more than in Portugal. But usually, northern atmosphere drops during the summer because people go on vacation. And peaks usually during Cyber Monday, Black Friday, the end of the year, usually there's a peak there. It's quite common and quite interesting as well, I would say. But there's a lot to explore. And Internet services is another one. For example, this year, we added not only the overall perspective to Internet services, but also generative AI. For example, in Portugal, Chantipiti is number one, Perplex number two, GitHub Copilot number three. Yeah, there's many things to explore in terms of microsite, for sure. And I think that's a very cool one to show off. People can go there, radar.calfire .com slash year-in-review, and just browse through the countries and the metrics they want to see. From these metrics, we didn't spoke still about SpaceX, but that's a popular one, usually, the growth of SpaceX. Have you been surprised on the growth every year? We've been doing this, I think, for three years now. Every year, this is like the third year, always growing. It should be. But I think the flip side is that we see a lot of traffic for the countries that have had Starlink service before the given year. We still see the growth there. And then we see, generally, very aggressive growth when a country... When Starlink enables services in a country. And so they're really good about posting on X. They'll say, hey, a Starlink service is now active or now available in Portugal, let's say, or whatever. They generally, within a couple of days, will see traffic just absolutely hockey stick up. And so I think there's definitely a lot of pent-up demand still. For Starlink and for Starlink services. And I think that there's Amazon Leo, which is... They're finally, I think, getting to the point where they'll get their constellation in orbit and start offering services. And there's New Telset, OneWeb in Europe, and then a similar Chinese offering. So maybe we'll start to see more traffic from these other network providers in the future. But I think right now, Starlink definitely has a lock on this type of service. True. And for those hearing this in the podcast format, Starlink grew twice, two times, over two times growth during this year. It was higher last year. Pretty consistent pattern throughout the year as well. So pretty straight line almost. True. And you see that there's definitely a growth pattern, even if it's less than last year, for example. And Armenia, I think, was one of the 20 countries that Starlink was added. Yep. So if you scroll down a little bit more, you can see it basically starts... Traffic starts there, what is that, probably April-ish, May-ish. Other things that we usually have, and this is also... Yeah, I think the post-monthly is definitely worth calling out. This is something, a metric... It's a key metric that I think we've really been focused on a lot at Cloudflare. We've been tracking it now for almost two years, since it really began to be integrated into the leading browsers. What we're seeing drive a lot of the growth is the various browsers setting post-quality encryption basically as a default. So we're using TLS 1.3, the PQ encryption is supported by default. So we saw those initial... You can see the growth there in 2024, the dotted line. In April, that's probably when I think Chrome probably turned it on. So you can see... So the growth there probably maps to more people adopting the latest version of Chrome. And then this year, it's gradually grown. I think Firefox gradually made it to default. And then that bump in the September timeframe is when the Apple iOS updates enabled PQ by default. So we saw... I think we're up to about... We're probably over 25% of the traffic we see from iOS devices right now, or iOS devices in PQ. But it basically drove it to more than half of the human -generated TLS 1.3 traffic we see at this point is using post-quality encryption. It's quite amazing to see the expansion. Since last year, it was around 30% and even lower initially. And then this year, around 30% when the year started, and more than half now at the end of the year. For those who don't know, we've done a few episodes about post-quantum cryptography in the past. But it's quite important when quantum computers come around, they will break encryption as we know it. And this post-quantum encryption makes sure that that encryption is not broke. So that means our data currently will be secure if it's post-quantum ready. And so it's all about security and privacy. Right. And remember that this is looking at post -quantum encryption between an end-user's client and Cloudflare. One of the things we're working with internal teams on is bringing a perspective to post-quantum encryption between Cloudflare and the customer origin. So something that customers need to remember is that we're protecting the data that we're sending to an end-user, if possible here with post -quantum. But they really should be implementing on the origin side so that we can secure that Cloudflare to origin connection with post-quantum as well. Yeah, makes sense. Another topic do you want to mention here, David, in terms of your any win through AI? I mean, Internet outages, obviously that's where you and I both spend a non-trivial amount of time. You know, we saw about 174 major outages this year. So as we talk about the blog posts we've published on this, that's certainly not an exhaustive count. There are others that we didn't cover. But this year, I think it was almost half of them were driven by government shutdowns or government-directed shutdowns, I should say. Government shutdowns happened in the US, that's separate. But, you know, seeing that's the vast majority of those. And a lot of that is the individual shutdowns in Iraq and Syria and other countries like that, designed to prevent cheating on exams. You know, we saw government -directed shutdowns in a few other countries around protests. So trying to prevent the Internet, either trying to prevent news and video about the protests from getting out or trying to prevent citizens from protesting from organizing. And then, you know, power outages are always obviously an issue where we'll see, you know, Internet traffic drop from a given country when there's a power cut. And then cable cuts, you know, both domestic, terrestrial, as well as submarine, always have issues there. It makes sense. And this timeline also gives the people the possibility to check definitely in the summer, especially because of the government-directed ones. That's the exam, right? The exam period in Iraq and Syria are where those clusters are. Yeah, and it's really cool to explore during the year when those were more concentrated. You can definitely see there's a trend there. Yeah, absolutely. Anything different from this year regarding the outages, David? So I think the, I don't remember exactly which were which, but I think, you know... There's always a lot. The power outages and cable cuts. Any different ones, but something out there. The number of outages due to power outages and cable cuts, one of them had like dropped by half and one of them like doubled year over year. So, you know, but other than that, I think, you know, there are largely the usual suspects, you know, I think it's anything that's going to cause, anything that damages infrastructure, whether it's service themselves, like one of the ones we have listed as a fire, there was a fire at a data center at a major provider in Egypt. So that obviously damaged, you know, physical infrastructure there, which took them some time to get back, you know, weather and so on. So things like hurricanes and typhoons and things like that will damage infrastructure, causing Internet outages, say with natural disasters like earthquakes. Where should we go next, David? Oh, let's see. So how about the global speed test activity? So that's another new metric we added this year. So, you know, Cloudflare has the Cloudflare speed test, speed.Cloudflare .com. So users can go there and, you know, you click the button and it runs a pretty comprehensive speed test looking at, you know, upload speed, download speed, and then idle and load a latency. You know, we've seen millions of these tests, but we were curious, you know, where are they coming from? And, you know, didn't anything change in an interesting way over the course of the year? So what we did is we took all the speed tests that were taken over the course of 2025 and plotted them by generally by general location and then animated that over the course of the year. So you can see, you know, what kind of activity happened and where, you know, where are people most interested in getting a sense of the quality of their connection? So one of the things we saw, of course, was as we call it there, you know, London was one of the hotspots. Los Angeles was another one. And then there were a couple of hotspots also in the APAC region we saw as well. It's a fun calling in Japan. That's interesting. And on that note, we also have the Internet quality, always a popular one as well with the peninsula, with Europe and Iberian Peninsula being on top with Portugal and Spain there for download speed, but also upload speed. Yeah, I mean, so one of the interesting things is that Spain has a, I guess, we used to call it a national broadband plan when I started, you know, dealing with this stuff, you know, 17, 18 years ago, where they basically, Spain basically said, we talked a little bit more in the blog post that, you know, the government said, you know, to the providers, you will get, you will make broadband gigabit connectivity available basically to everybody, you know, by 2025. So not to say that everybody has adopted that, not to say that, you know, it's necessarily affordable. I don't actually don't know what the costs are, but, you know, I think clearly the work that's been done to improve the connectivity quality in Spain is showing up, you know, here to some extent. That makes sense. Also the latency with Iceland there being the best. Yep. Yeah. So latency is important too. I think that's one of the things that some of the folks in the industry talk about where, you know, especially some of the folks I know from some of the speed testing services is that they feel almost bad that they convinced everybody over the years that connection quality is really all about download speed. You know, that's really important, but it's not the end all be all for more of the interactive real -time experiences like, you know, watching a video or even recording this online gaming, things like that. Latency and having low latency is really important. So you can have a really high download speed, but if you've got high latency on that, the connection quality ultimately becomes terrible. Whereas a lower speed connection with much lower latency can actually give you a better experience. Makes sense. There's also, I think, a new one regarding DDoS attacks, right? Yes. Yes. The hyper volumetric DDoS attack size progression. Yeah. So a week or two ago, we published the Q3 DDoS report and that had called out a 29, it was 29.7 terabit attack, which, you know, is just insanely big. And then what we saw, we sort of pulled the data through the end of November was that there was actually another set of attacks in November that drove that peak up to over 31 terabits. I think it's 31.4 terabits. Did we do the rounding there? I'm not sure. It is. It is. But what's really interesting too to see is, you know, we'd hit a peak and then sort of like the peak would carry over for a few months. And then there'd be another round of attacks and we'd hit another peak. And then sort of in the September timeframe, there was a big flurry of attacks. And what we unfortunately didn't show here is the scatterplot of the attack activity. And you can definitely see the attack activity is heavily concentrated during those timeframes where we saw the peaks occur, where we saw, you know, the growth. And then it's just very, very concentrated like the September to November, September to December timeframe. True. With lots and lots of attacks happening. And the volume is just crazy. The volumes, the record volumes, these are record volume of attacks for sure. Also one that usually brings some attention, website technologies. And sometimes, and I was seeing someone mentioning the WordPress being on top here, which was interesting recently. Yep. And that's something where there have been stats across the industry for several years that talk about just the large share, the big share of sites that run on WordPress. And I think our stats, you know, not I would say verify, but they align with those other observations as well. True. And this is using a very cool radar tool called URL scanner to analyze websites and the top 5,000 domains to identify the most popular technologies here. Right. We already mentioned the blog, but this is the blog that you wrote about that gives the overview of the year in many of these trends that we've been discussing. Trying to pull out key findings, you know, what are some interesting bits that we saw across each of these metrics and then drilling down a little bit into those key findings and some other interesting observations within the body of the blog post itself. Exactly. There's a lot to explore in the blog and in the microsite as we discussed. We also have the Internet services blog that I know a bit about. Why not actually starting there with the microsite specifically? Because the microsite has that section specifically. One of the things that I would say was surprising this year was first, how meta still rules social media. But Instagram has been actually increasing in the overall, in the global perspective. While, for example, X has been decreasing. And YouTube also performing really well with TikTok dropping in terms of the overall. The other thing that was really surprising this year was how Google Gemini and Perplexing Cloud are now coming after ChatGPT as number one. And Gemini, and we have this in the blog specifically, Gemini ended the year, right at the end of the year, was, this is not the blog, was right at the end of the year, coming up as number second in generative AI trends. So that was also a cool perspective here. There's a lot to explore in terms of e -commerce, video streaming. But Gemini being, ending the year as second was definitely an interesting one. And also DeepSeek in January was as high as number three, then it dropped. So- Well, that made a huge splash when it came out. Things that I didn't know too much about, like Quai, which is the Chinese short video app, really popular in Latin America and also Southeast Asia. I didn't know about that. And I knew, I learned about that writing this blog post and checking the trends. Also really interesting to see that it's not only the players that most people know in some countries that are performing well, others are performing well as well. Roblox ruling gaming was not a big surprise. Right, yeah. There's a lot to unpack in the blog. We try to show specific metrics and what happened during the year in some of those services. May that be, for example, have a news area regarding like the Iran-Israel war and what happened to news science at the time, peaking in our ranking. There's a lot to unpack. Also the Black Friday momentum for several apps like Shopee and Temu really performed well this year as well. Was there anything in your research, your findings that surprised you about the, what's that? Can you not hear me? Well, David, it's already long, our segment. What would be the main thing that you think people should take from this year call for your interview? I think the Internet continues to grow and evolve. I think we see that certainly through all of the metrics that we're collecting, that we're analyzing. I think, so recognizing that even though it's such a part of our daily lives, it hasn't finished growing yet. I think the other things to take away would be just the importance of resilience, seeing all the different sorts of Internet outages that are out there. And if you're a business owner, if you're an application owner, making sure that you've got plans for if your upstream providers have issues. And I think the other pieces from the security perspective is just so many different types of attacks and they're just getting bigger and more widespread, making sure that you have, again, as a business side, as an application owner, that you're taking the steps to protect your assets. Makes sense. And because 2026 is just around the corner, do you have any predictions thinking of what's coming? I know it's really difficult to do, but. I would love to have an Internet disruption section next year that is short and boring. I don't anticipate that's going to happen, unfortunately. I think we'll have, I think the AI metrics will continue to evolve as that industry just continues to evolve at a rapid pace. We'll see if Google continues to continue to crawl at the volume it does, it has been. We'll see if any of the other competitors pick up the pace. We'll see, I think it will be interesting to see if there's growth in agent traffic. One of the things we're also doing is looking at not only training and search and user action, but also breaking out another category there for agents for those bots or crawlers that are specifically identified as such. So seeing, are we going to see that kind of traffic growth occur as well? Yeah, the AI perspective is always interesting for sure. Things are changing so much. Seeing the evolution, both of AI crawlers, but also of Google bots there could be quite interesting to see. Also how the behavior can change potentially. I'm curious on that for sure. One of the things- The Internet services piece also, we've talked about elsewhere, like the top couple, the bottom couple were pretty static, but then in the middle of the top 10, there was some movement. So we'll see, does that movement change? Does anybody, does Google and Facebook eventually get unseated from the top couple by an AI tool or by a social media tool or something like that? Or has that list kind of hit a stasis? And to be honest, the generative AI section or category is one of the most interesting ones for Internet services, curious to see how Gemini continues to perform against the chat GPT. Yeah, it's been so dynamic over the last couple of years. And if we'll have a new leader, that will be quite something. If that happens, a lot to unpack for what's coming in terms of 2026. Also DDoS, I don't think will start to not become a thing, unfortunately. Yeah, I'm hoping we don't have to extend that graph to like 50 or 60 terabits next year. True, true. The way things are heading, we never know. One of the things that we don't have in the report, but we had many blog posts during the year, for example, is how traditional news sites are continuing to lose traffic, especially with referrals from Google, for example. So that means less traffic, less money for them in terms of how they can add value. You'll see the business model for the web change. Yeah, so let's see how that also performs and changes, something there that changes. Interesting times for sure, David. Absolutely, always. This was great. Thank you. And let's see how 2026 brings us. Looking forward to it. And that's a wrap. And that's a wrap.