A Year of New Lenses on the Internet
Cloudflare Radar, launched in September 2020 as a free resource for observing global Internet patterns—from human and bot traffic to attacks and protocol adoption—has seen significant expansion this year. The past twelve months have brought a slate of new features designed to offer more granular views into network performance, security, and traffic trends. Here is a breakdown of the most significant additions and observations from the past year.
New Analytical Tools and Data Views
The 2023 updates have focused on providing deeper technical insights into specific facets of the Internet. These new sections are also available through the public API, enabling programmatic access to the data.
Among the new tools is the URL Scanner, which generates comprehensive reports on any given link. If you are uncertain about a link’s safety or need to inspect a site's technical setup, the scanner provides a wealth of data. Reports include risk assessments, SSL certificate details, HTTP request and response information, performance metrics, DNS records, cookies, and a list of the technologies and libraries in use on the page.
Another major release is the Internet Quality page, launched in June. This section provides insight into connection performance at both the country and network (autonomous system) levels. It charts bandwidth, latency, and jitter over time, using data from benchmark tests and speed.cloudflare.com results. A world map allows for quick visual comparison between countries on these metrics. The page also features individual profiles for specific networks, such as Starlink's AS14593. Of the various metrics, latency is highlighted as a primary indicator of connection quality and overall user experience.
Tracking Popularity and Routing Health
In July, the Domain Rankings page was enhanced with a Trending Domains feature. While the top 100 list remains largely stable with major global sites like Google and Facebook, the trending lists capture short-term surges in interest from the previous day and week. This has proven effective at reflecting real-world events, such as nba.com trending in 28 locations during the NBA Draft and rt.com gaining traction in multiple countries during the Wagner group mutiny. More recently, flightradar24.com trended in both Russia and Ukraine following a plane crash involving the group’s leader.
The Routing section, launched in late July, shines a light on the Internet’s backbone infrastructure. Routing determines the path traffic takes from source to destination, and anomalies can signal connectivity disruptions. This page offers insights into the deployment of secure routing protocols for a given country, as well as connectivity details and announced prefixes. It also addresses the inherent insecurities of the Border Gateway Protocol (BGP) by presenting detection results for route leaks and hijacks. The system identifies potentially malicious events where attackers might intercept or redirect traffic destined for a victim's network. A related blog post details the design, implementation, and integration of the BGP origin hijack detection system, including how notifications are generated.
War, outages, and national events: what shaped global traffic in 2023
Cloudflare Radar tracked a wide range of disruptions and traffic anomalies across 2023. The year saw government-mandated shutdowns, conflict-related outages, and notable shifts in traffic patterns tied to holidays and major public events. Below is a look at some of the key observations from the past 12 months.
Conflict zones: Ukraine, Sudan, and Niger
Cloudflare's analysis of Internet resilience in Ukraine, now more than a year into the war, highlights several distinct phases of disruption. Early in the conflict, infrastructure damage and access restrictions in besieged areas like Mariupol caused significant outages. Later, airstrikes on energy infrastructure led to further instability. Application-layer cyber attacks against Ukraine rose 1,300% in early March 2022 compared with pre-war levels, yet the country's Internet remained largely resilient. The report also notes major growth in Starlink traffic from Ukraine during this period.
In Sudan, armed conflict that began on April 15, 2023, led to a mix of clear outages and general traffic declines. Local autonomous systems — including Sudatel, Mobitel, and MTN — remained the most affected through the year, as shown in Cloudflare's 12-month traffic graphs. More recently, the coup in Niger produced a distinct traffic drop, though without signs of consistent connectivity disruption, suggesting the change was linked to shifts in human Internet usage rather than technical failures.
Major operator outages
When large Internet providers experience technical failures, the effects are visible in traffic data. In early April 2023, the UK's Virgin Media suffered two separate multi-hour outages on April 4. Cloudflare's post-mortem examined the impact on Internet traffic, the availability of Virgin Media's web properties, and how BGP activity provided clues to the root cause.
Holidays and public events
National holidays and major ceremonies consistently show up as dips in Internet traffic. The Easter long weekend (April 7-10, 2023) produced the lowest traffic levels of the year up to that point in multiple countries, including Italy, Poland, Germany, France, Spain, Portugal, the US, Mexico, and Australia. Compared with the previous Sunday, the drop was steepest in Poland (22% lower), Italy (18% lower), and France (16% lower).
Other religious observances also left clear marks: Orthodox Easter had its largest impact in Greece, while Ramadan-related changes in eating patterns altered Internet usage in several countries with significant Muslim populations. In Israel, Passover traffic dropped by as much as 24%.
The coronation of King Charles III on May 6, 2023, produced distinct spikes and dips synchronized with key moments of the ceremony. Traffic also dropped on the following day during the Coronation Big Lunch and again during a late-night speech by Prince William, falling up to 18% compared with the previous Sunday. Canada and Australia showed similar pattern shifts over the coronation weekend. Cloudflare's analysis also covers traffic changes observed when Queen Elizabeth II passed away on September 8, 2022.
Government-mandated shutdowns
Following the arrest of former Prime Minister Imran Khan, violent protests led the Pakistani government to order shutdowns of mobile Internet services and to block social media platforms. These mobile network outages lasted for several days. Cloudflare examined the effects on national traffic and on usage of its 1.1.1.1 DNS resolver, which many Pakistanis appeared to turn to in an effort to maintain access to the open Internet.
Exam-related shutdowns were a recurring theme in 2023. Since early June, Iraq implemented a series of multi-hour shutdowns that continued through July and into August, as documented in Cloudflare's Outage Center. Algeria took a different approach, relying on content blocking rather than full-scale Internet shutdowns to prevent cheating during baccalaureate exams. Similar exam-related measures were also deployed in Syria over the summer, as they had been in previous years.
From conflict-driven outages to government-directed shutdowns and holiday traffic dips, 2023 provided no shortage of Internet resilience tests.
Cloudflare Radar’s report library
Beyond the interactive dashboards, Cloudflare Radar hosts a dedicated reports section that blends long-form analysis with data visualizations. Coverage ranges from the Project Galileo 9th Anniversary to quarterly updates on browser market share and search engine usage. Some of these, like the DDoS trends report, are mirrored as blog posts, while others live exclusively on the Cloudflare blog — notably the Internet disruption summaries and the Application Security report.
Q2 2023: a busy quarter for disruptions
Cloudflare’s Q2 2023 Internet disruption summary documents a wide range of causes. Government-directed shutdowns tied to “exam season” in several Middle Eastern and African countries persisted through August. Severe weather knocked out connectivity on Guam via a “Super Typhoon,” while cable damage hit Bolivia, the Gambia, and the Philippines. Power outages disrupted service in Curaçao, Portugal, and Botswana.
Technical failures affected SpaceX Starlink’s satellite service and Virgin Media in the United Kingdom, while cyberattacks contributed to outages in both Russia and Ukraine. Military action led to disruptions in Chad and Sudan, and maintenance windows caused outages in Togo, Republic of Congo (Brazzaville), and Burkina Faso.
The Q1 2023 overview added another cause category: earthquakes. The 7.8-magnitude quake that struck Turkey and Syria in early February resulted in Internet connectivity issues across several regions for weeks.
DDoS threat report: 2023 Q2
The Q2 2023 DDoS threat report focuses on a marked increase in attack sophistication. Pro-Russian hacktivist groups REvil, Killnet, and Anonymous Sudan united to target Western sites. Exploits of the zero-day vulnerability TP240PhoneHome rose 532%, and attacks on cryptocurrency platforms jumped 600%.
An interactive version of the report is available on Radar, alongside a new security section component for examining attack activity by country or region. The preceding Q1 2023 report documented a record hyper-volumetric 71 million requests per second attack.
Application Security observations
Cloudflare’s Application Security report for Q2 2023, running annually since 2022, offers these key findings:
- Average daily mitigated HTTP requests declined 2 percentage points to 6% from 2021 to 2022, though high-activity malicious days remained visible.
- Geo-location-based blocking is increasingly common among application owners.
- Known CVEs remain a major vector; Cloudflare also published an analysis of the top exploited vulnerabilities of 2022.
- Over 10% of non-verified bot traffic is mitigated on average, with the rate currently down 6 percentage points versus the prior report.
- Browsers generate 65% of global API traffic.
- HTTP anomalies top the list of API attack vectors at 64%, followed by SQLi injections at 11% and XSS attacks at 9%.
For a broader landscape, Cloudflare compiled an August 2023 reading list of security and attacks-related content.
New ways to look back
Cloudflare Radar’s 2023 releases aimed to broaden the scope of observable Internet behavior, from connection quality metrics to trending domains and routing changes. In August 2023, the platform introduced a date picker that lets users select arbitrary time ranges to review past data:
Radar continues to publish insights across disruptions, routing, traffic, attacks, and Internet quality. Updates are available on X at @CloudflareRadar, on Mastodon at noc.social/@cloudflareradar, and on Bluesky at radar.cloudflare.com.
