Internet Explorer 11’s Retirement: A Traffic Autopsy
When Microsoft announced in May 2021 that the Internet Explorer 11 desktop application would be retired on June 15, 2022, for Windows 10 client SKUs and Windows 10 IoT, it set in motion a transition that affects the vast majority of desktop Windows systems worldwide. Now that the retirement date has passed, we have analyzed traffic patterns across Cloudflare’s network to see how the browser’s last months unfolded.
Global trends in the final months
Chromium-based Microsoft Edge has been the designated successor since its general availability in January 2020, with automatic rollout to Windows users beginning in June 2020. Microsoft’s two-year runway and explicit retirement announcement should have driven a noticeable decline in Internet Explorer usage, and indeed global request traffic for Internet Explorer 11 dropped by approximately one-third between January 1 and June 20, 2022.
The weekly usage pattern is clear: weekday peaks and weekend troughs indicate that most remaining usage occurs in workplaces rather than homes. The relatively modest year-to-date decline suggests that businesses were not rushing to migrate before the deadline. We expect a more aggressive drop as Microsoft’s two-phase plan redirects users to Edge and then disables the browser, but traffic from Internet Explorer 11 will never entirely disappear. Edge’s “IE Mode” identifies itself as Internet Explorer 11, and the retirement announcement does not affect Windows 8.1 or Windows 7, where legacy usage will continue.
Older versions of Internet Explorer also persist. We still see millions of daily requests from clients claiming to be Internet Explorer 2, released in November 1995. After version 11, Internet Explorer 7 generates the next-largest request volume, with fairly consistent traffic trends. Internet Explorer 9 was the next-largest contributor through late May, when Internet Explorer 6 traffic surged. Internet Explorer 7 saw a similar bump at that time.
Geographic concentration and a Brazilian anomaly
The United States accounts for the largest share of Internet Explorer 11 requests year-to-date, with daily peak traffic declining about one-third over the period, mirroring the global pattern. Japan has the second-largest volume at roughly one-fourth of the U.S. numbers — a finding consistent with published reports that Japanese businesses and government agencies were unprepared for the retirement and may face months of disruption.
More surprising are the traffic patterns from Brazil, where Internet Explorer 11 request volumes appear to quadruple for several weeks in January and again from early May through mid-June, with a significant spike in March. Bot score analysis shows these increases are not human-driven; automated traffic is presenting itself as Internet Explorer 11.
Correlating these spikes with Web Application Firewall (WAF) mitigation activity reinforces that conclusion. The periods of elevated mitigation align closely with the higher automated traffic levels, indicating that a botnet was using an Internet Explorer 11 user agent in its attacks.
Bot versus human traffic by version
Bot score classification provides deeper insight into the residual traffic from deprecated Internet Explorer versions. For requests classified as “likely human,” both versions 11 and 7 show clear weekly cycles that suggest business-driven usage during weekdays. For Internet Explorer 7, this pattern becomes more pronounced after mid-February, when request volume drops significantly.
That decline in “likely human” Internet Explorer 7 traffic corresponds with an increase in “likely automated” traffic for the same version. Since the human traffic did not appear to migrate to another Internet Explorer version, this shift may stem from improvements to the machine learning models behind bot detection that were rolled out in January and February. Notably, automated request volumes for Internet Explorer 11 and 7 have tracked very closely since mid-March, for reasons that are not immediately clear.
Looking at the ratio of automated traffic per version, Internet Explorer 11 saw its proportion grow from about 60% at the start of 2022 to roughly 80% by June. Internet Explorer 7 began the year around 40% automated, then more than doubled to over 80% in February and held steady. Only a fraction of this “likely automated” traffic was mitigated by the WAF, suggesting a mix of malicious bots and benign tools such as performance testers.
Internet Explorer 6 and 9 were notable request volume drivers earlier in the year, but their traffic is mostly bot-driven. Internet Explorer 6 started 2022 around 80% automated, climbing to 95% by June, and its mitigation percentage rose alongside the automated share, with spikes aligning to bursts of bot activity. Internet Explorer 9 began the year near 90% automated, dropped to about 60% at the end of January, then gradually climbed back to the 75–80% range, with consistent mitigation levels throughout.
For the oldest Internet Explorer versions targeted by automated traffic, bots frequently comprise more than 80% of request volume and reached 100% on several days during the year. Mitigated traffic was generally under 30%, though Internet Explorer 2 often hit the 50% range and spiked as high as 90%.
Edge: the replacement’s pattern
With Microsoft positioning Edge as the future, we examined its usage as well. Analyzing the last ten Edge versions year-to-date, the graphs show strong enterprise adoption with clear weekday peaks. Edge’s four-week major release cadence is visible in the version-level traffic data, and a long tail of usage extends roughly eight weeks past each release as enterprise customers manage staged updates.
Interesting patterns appear in the bot score split for Edge traffic. About 80% of requests for a given version are classified as “likely human” for roughly eight weeks after release, then gradually taper to around 60%. This indicates that bot developers recognize the value of presenting themselves as the latest version of Microsoft’s browser. There is no meaningful correlation between WAF mitigation percentages and automated traffic levels or release cycles.
A persistent legacy
The traffic we observed during Internet Explorer 11’s final months brings to mind the “I’m not dead yet” scene from Monty Python and the Holy Grail. These deprecated browsers continue to claim they are alive from a traffic perspective. The majority of Internet Explorer traffic seen by Cloudflare — including version 11 — is not coming from actual browser clients on user systems but from bots and automated processes. WAF analysis suggests the portion of that automated traffic coming from malicious sources varies significantly by version. As Microsoft works through its two-phase user migration plan, both overall request volumes and the bot-to-human ratio for Internet Explorer will continue to shift, and we plan to revisit this analysis later in the year.
