Cloudflare Radar’s 2021 Review: Traffic, Lockdowns, and Attack Peaks
Cloudflare Radar has published its 2021 Year In Review, providing a detailed look at how the Internet evolved over the past twelve months. The interactive site, launched in September 2020, allows users to explore trends in traffic, mobile usage, cyberattacks, and category popularity by country and city. This year’s edition adds a mobile vs. desktop traffic chart and expands attack data to include a selection of countries.
The data reveals a year of continued global growth, but one shaped less by sweeping, uniform lockdowns and more by regional restrictions. It also highlights the influence of major events—from the Tokyo Olympics to the UEFA European Championship—and the persistence of cyber threats.
Global Traffic: Growth Without the 2020 Spike
Unlike 2020, when a sudden, sustained surge in traffic followed the initial pandemic lockdowns, 2021’s growth was more distributed. While global traffic increased steadily throughout the year—with the highest levels reached in the final months—the sharp peaks seen in March and May of the previous year were largely absent. The single highest day of growth was December 2, 2021, which saw traffic 20% higher than the first week of the year.
Several smaller bumps, however, appear to correlate with recurring pandemic-related restrictions. The chart below ranks the months with the most significant spikes in global Internet traffic for 2021.
An examination of specific countries reveals the impact of local restrictions. For instance, Canada’s lockdowns in February and March are reflected in higher traffic growth figures. Similarly, the UK saw a pronounced increase from January through March, a period that included renewed lockdowns and school closures, which subsided as measures were relaxed. Portugal showed a comparable pattern, with its January 21 lockdown measures putting the first three months of the year in its top three for traffic growth.
Patterns varied elsewhere. France experienced a rise in traffic during April and May, aligned with another round of lockdowns, while Germany’s data shows a bump in May following a return to mandatory work-from-home the previous month and the start of a lockdown in late 2020 that included school closures. South Korea also saw spikes in February, April, and May. In the United States, May was a month of high growth, coinciding with new CDC guidance on masks, though its overall trajectory was more even than in 2020.
Mobile vs. Desktop and the Thanksgiving Anomaly
New this year is the ability to chart the share of traffic coming from mobile devices versus desktop. Globally, mobile usage was most prevalent in July and August, typical vacation months in the Northern Hemisphere, but January and November were also strong. The trends, however, vary significantly by country.
In the United States, desktop traffic dominates throughout the year. The one exception was the week of Thanksgiving (November 25), when mobile traffic took the lead for the first and only time. The UK saw a similar but longer-lasting pattern, with mobile traffic prevailing from June through August. In Singapore, the situation is almost reversed: mobile traffic is generally higher, with desktop exceeding it only on select days in February, March, and the period after late October.
City-Level Insights: Remote Work and Event Effects
The new city-level analysis offers a glimpse into how commuting and major events affected connectivity. In the San Francisco Bay Area, a comparison between early 2020 and the lockdown months of April and May shows how traffic shifted from central business districts to residential areas, a trend that has persisted as remote work remained widespread among tech companies. Only in June 2021 did traffic begin to increase again, primarily in areas further from the city center.
London presented a different story. The city’s internet activity picked up only in June, coinciding with the 2020 UEFA European Championship, with several matches played at Wembley Stadium. By July, and particularly August, a significant dip in activity suggested people were leaving the greater London area. Traffic began to recover in September and October, but predominantly outside the city center.
Tokyo, host of the Summer Olympics in late July and early August, showed low activity levels despite the global event being held in town. Conducted largely behind closed doors due to a state of emergency, the Games did little to draw crowds. Data shows a decrease in activity in August compared to June, when restrictions were rising in the lead-up to the event.
Other cities illustrate the ebb and flow of lockdowns. In Lisbon, a January lockdown caused activity to shift from the city core to its residential outskirts before a broader decrease in April and a recovery in May. Berlin saw high activity in its city and surroundings during March and April lockdowns, only to see it decrease in May and June as restrictions were relaxed, before picking up again in August and declining once more in the colder months of November and December.
Cyberattacks: July’s Peak and Log4j’s Arrival
Globally, the year’s largest attack peak occurred in early July 2021, reaching 82% of the baseline. This was more than a month after the high-profile Colonial Pipeline ransomware attack and followed a May that also saw attacks on Toshiba’s European business, the Irish health system, and meat processor JBS. November, the month of Black Friday, also registered a significant peak at 78%, with the week of December 6—when the Log4j vulnerability was disclosed—showing a 42% increase. A similar increase was observed in early October around the time of the Facebook outage.
The new country-level data shows considerable variance. The UK had a very sharp peak of 150% growth in attacks in August, which continued through September, with other increases in January and late November each. Attacks on the United States were more evenly distributed, but still had notable spikes—a 65% growth between August and September, a 58% spike in July, and a 48% increase in late May. France and Germany saw extreme peaks of 420% in late September and 425% in June, respectively.
What People Did Online
The data also reveals what people were doing online in 2021. E-commerce traffic in New York peaked on Black Friday, November 26, at 31.9% of traffic, followed by Cyber Monday at 26.6%. This differs from the previous year, where the rise of e-commerce during the first lockdowns put April 22, 2020, as a close second to that year’s Black Friday.
In London, this pattern was slightly different. Messaging traffic reached its highest point of 21.5% on Friday, February 12—two days before Valentine’s Day—while e-commerce still peaked on Black Friday at 20.7% of traffic. In Paris, travel websites saw their biggest share of traffic on June 7, 2021, the week before France reopened to international travelers, and messaging traffic hit an annual high of 24.4% on January 31, a day when new restrictions were announced.
Attack methods also had regional signatures. In Paris, attacks “faking search engine bots” made up 48.3% of activity on January 14, while “SQL Injection” peaked at 59% on April 29. In San Francisco, “information disclosure” was most prevalent, particularly in late November. The yearly data for all these trends—and much more—is available for exploration on the Cloudflare Radar Year In Review site.
