2025 in Review: AI Crawlers, Post-Quantum Encryption, and Bigger DDoS Attacks
Cloudflare’s sixth annual Year in Review, based on data from its network spanning 330 cities in over 125 countries and regions, offers a look back at the trends that shaped the Internet in 2025. The network handles over 81 million HTTP requests per second on average, with peaks above 129 million, and responds to roughly 67 million DNS queries per second. The report covers data from January 1 through December 2, 2025, and is organized into six main sections: Traffic, AI, Adoption & Usage, Connectivity, Security, and Email Security. New this year are several AI-related metrics, global speed test activity, and a breakdown of hyper-volumetric DDoS attack size progression. Underlying methodologies remain unchanged from previous years for consistency.
The report spans trends for over 200 countries and regions, though smaller or less-populated locations are excluded due to insufficient data. Some metrics are only available at the worldwide level. A companion post explores trends among the top Internet services specifically.
Traffic Growth and the Rise of Bots
Global Internet traffic grew 19% in 2025, with notable acceleration beginning in August. Starlink traffic doubled during the year, including traffic from over 20 new countries and regions. Googlebot again drove the highest volume of request traffic to Cloudflare, crawling millions of customer sites for search indexing and AI training. It was responsible for more than a quarter of all Verified Bot traffic and accounted for 4.5% of HTML request traffic on its own.
Post-quantum encryption continued its adoption curve: 52% of human-generated Web traffic is now post-quantum encrypted. The top 10 most popular Internet services saw some year-over-year shifts, and several category lists welcomed new entrants.
AI Crawling Explodes
AI-related crawling was a defining trend of 2025. Crawl volume from dual-purpose Googlebot dwarfed that of other AI bots and crawlers. While other AI bots combined accounted for 4.2% of HTML request traffic, Googlebot alone accounted for 4.5%. AI “user action” crawling increased by over 15x during the year.
Among leading AI and search platforms, Anthropic had the highest crawl-to-refer ratio. In robots.txt files, AI crawlers were the most frequently fully disallowed user agents. On Cloudflare’s Workers AI platform, Meta’s llama-3-8b-instruct model was the most popular, and text generation was the most common task type.
Adoption and Usage Patterns
iOS devices generated 35% of global mobile device traffic, and more than half of device traffic in many countries. The shares of global Web requests using HTTP/3 and HTTP/2 both ticked upward slightly. JavaScript-based libraries and frameworks remained integral to Web development. Go-based clients made one-fifth of all automated API requests.
Google remained the dominant search engine, with Yandex, Bing, and DuckDuckGo far behind. Chrome remained the top browser across platforms and operating systems, except on iOS where Safari held the largest share.
Connectivity and Quality
Nearly half of the 174 major Internet outages observed worldwide in 2025 were caused by government-directed regional or national shutdowns. IPv6 adoption remains uneven: globally, less than a third of dual-stack requests were made over IPv6, but in India that figure was over two-thirds.
European countries boasted some of the highest download speeds, all above 200 Mbps. Spain was consistently among the top locations across measured Internet quality metrics. London and Los Angeles were hotspots for Cloudflare speed test activity. Mobile devices generated more than half of request traffic in 117 countries and regions.
Security Landscape
Cloudflare’s systems mitigated 6% of global traffic — either as potentially malicious or for customer-defined reasons. The United States originated 40% of global bot traffic, with Amazon Web Services and Google Cloud together accounting for a quarter of it. Organizations in the “People and Society” sector were the most targeted during 2025.
Routing security continued to improve, with the shares of RPKI valid routes and covered IP address space both rising throughout the year. Hyper-volumetric DDoS attack sizes grew significantly over the course of 2025.
On the email front, more than 5% of messages analyzed by Cloudflare were malicious. Deceptive links, identity deception, and brand impersonation were the most common threat types. Nearly all email originating from the .christmas and .lol top-level domains was either spam or malicious.
19% Global Traffic Growth, With an Accelerating Back Half
To measure traffic trends for the year, Cloudflare Radar uses the average daily traffic volume excluding bot traffic, with the second full calendar week of January (January 12–18) as the baseline. The percent change is relative to that baseline, and the trend line is smoothed as a seven-day trailing average.
Traffic was relatively flat through mid-April, hovering within a couple of percent of baseline. Growth then picked up to roughly 5% above baseline by May, remaining in the +4–7% range until mid-August. From there, growth accelerated steadily through September, October, and November, peaking at 19% for the year. That rate is about 10% higher than the 17% growth seen in 2024. In previous years back to 2022, the back-half acceleration started in July; the reason for this year's delayed onset is unclear.
Botswana saw the highest peak growth of any country/region, reaching 298% above baseline on November 8 and ending the year 295% above baseline. Botswana and Sudan were the only countries where traffic more than doubled over the year.
Extended Internet disruptions are also visible in the data. Tanzania imposed an Internet shutdown on October 29 in response to election-day protests; after a one-day shutdown, a second followed from October 30 to November 3. Traffic had been more than 40% above baseline before the shutdowns but dropped over 70% below baseline, recovering quickly once connectivity was restored. Jamaica showed a similar pattern ahead of Hurricane Melissa on October 28: traffic spiked before the storm, dropped significantly after power outages and infrastructure damage, and rebounded to just above baseline by early December.
Top Services: Generative AI Shakeup and New Entrants
Service rankings for the Year in Review cover the 11-month year-to-date period, based on anonymized query data to the 1.1.1.1 public DNS resolver from millions of users. Domains belonging to a single service are grouped together for these purposes, and rankings are provided for an overall list plus nine categories.
Google and Facebook again held the top two overall spots. Microsoft, Instagram, and YouTube each moved up while AWS dropped one position, and TikTok fell four positions.
Among Generative AI services, ChatGPT/OpenAI remained on top. Perplexity, Claude/Anthropic, and GitHub Copilot moved up, while Google Gemini, Windsurf AI, Grok/xAI, and DeepSeek were new top-10 entries for 2025.
Shopee is a new entrant to the E-Commerce list, and HBO Max joined the Video Streaming ranking, discussed in more detail in a separate blog post. This year, top service insights at a country/region level are being shared for the Overall, Generative AI, Social Media, and Messaging categories — expanding on last year's Overall-only view.
Starlink: 2.3x Growth, 20+ New Countries
Analyzing aggregate request traffic associated with Starlink's primary autonomous system (AS14593), global request volume from the satellite service grew 2.3x over the year. Traffic typically grows rapidly within days of Starlink announcing availability in a new country/region, and that pattern held in 2025.
Over 20 countries/regions newly announced Starlink availability during the year, including Armenia, Niger, Sri Lanka, and Sint Maarten. Traffic was also observed from locations not currently marked for service availability on Starlink's map, but where the service's published geofeed shows associated IPv4 and/or IPv6 prefixes — likely explained by roaming users with portable service in those areas.
Among countries where service was active prior to 2025, Benin, Timor-Leste, and Botswana saw some of the largest traffic growth at 51x, 19x, and 16x, respectively. Those launches were announced in November 2023, December 2024, and August 2024 respectively.
Services like Amazon Leo, Eutelsat Konnect, and China's Qianfan continue growing their constellations and moving toward commercial availability, and may be subjects of future traffic analyses.
Googlebot Still Top Source of Requests
To visualize aggregate request traffic from the IPv4 Internet to Cloudflare in 2025, a Hilbert curve approach is used, aggregating addresses into /20 prefixes to keep the visualization data manageable. At the highest zoom level, each square represents traffic from 4,096 IPv4 addresses.
For the third consecutive year, the IP address block with the maximum request volume was Google's 66.249.64.0/20, one of the blocks used by the Googlebot web crawler for search indexing and AI training. That prefix accounted for nearly 4x the IPv4 request traffic of the next largest source, 146.20.240.0/20, part of a larger block announced by Rackspace Hosting — expected, given the number of web properties on Cloudflare's network and Googlebot's aggressive crawling.
A new search capability in the visualization allows looking up an autonomous system to see how broadly a network's IP address holdings are distributed across the IPv4 universe. AS16509 (AMAZON-02) shows the result of Amazon's large IPv4 acquisitions over the years, while AS7018 (ATT-INTERNET4) illustrates AT&T's holdings including the 12.0.0.0/8 block — over 16 million IPv4 addresses owned by AT&T since 1983.
The State of Post-Quantum Encryption
Post-quantum cryptography aims to protect data from "harvest now, decrypt later" attacks in which adversaries capture data today for decryption by future quantum computers. The Cloudflare Research team has been working on post-quantum cryptography since 2017, publishing regular updates on the state of the post-quantum Internet.
After significant growth in 2024, the global share of post-quantum encrypted traffic nearly doubled through 2025, going from 29% at the start of the year to 52% in early December.
Twenty-eight countries/regions saw their share of such traffic more than double during the year. In Kuwait, the share nearly tripled from 13% to 37%; Puerto Rico's grew from 20% to 49%. Both locations saw significant increases in mid-September, concurrent with Apple releasing operating system updates in which TLS-protected connections automatically advertise support for hybrid, quantum-secure key exchange in TLS 1.3. Over half of request traffic in Kuwait and Puerto Rico is from mobile devices, with approximately half of that from iOS, explaining the impact of the software update on traffic share.
The share of post-quantum encrypted traffic from Apple iOS devices grew significantly after iOS 26 was officially released in September. Just four days after release, the global share of requests with post-quantum support from iOS devices went from under 2% to 11%. By early December, more than 25% of requests from iOS devices used post-quantum encryption.
The Bot Landscape: Search and AI Crawlers Lead
Cloudflare Radar's Bots Directory provides information about Verified Bots and Signed Agents, including their operators, categories, and traffic trends. Verified Bots must adhere to a set of requirements and are verified through either Web Bot Auth or IP validation. Signed Agents are controlled by end users with a verified signature-agent from their Web Bot Auth implementation, subject to a separate set of requirements.
Googlebot — used to crawl site content for search indexing and AI training — was the most active bot seen by Cloudflare in the year, responsible for over 28% of Verified Bot traffic. Its activity was highest between mid-February and mid-July, peaking in mid-April. Other notable Google-operated bots included Google AdsBot for monitoring sites carrying Google ads, Google Image Proxy for caching images in emails, and GoogleOther used by product teams to fetch publicly accessible content.
OpenAI's GPTBot was the next most active, with about 7.5% of Verified Bot traffic and volatile crawling activity in the first half of the year. Microsoft's Bingbot generated 6% of Verified Bot traffic with relatively stable activity year-round.
Search engine crawlers and AI crawlers were the most active Verified Bot categories. Search engine crawlers drove 40% of Verified Bot traffic, AI crawlers about half as much at 20%, and search engine optimization bots over 13%.
AI traffic keeps climbing — with a familiar geography
Interest in AI is no longer a novelty on the network edge; it has become a structural part of Internet traffic patterns.
Looking at Cloudflare’s own customer base, the amount of traffic to AI services in 2025 doubled in just the last six months of the year, following a trend that started the year before. The growth is headline-worthy, but the more telling data point is where the traffic originates. Almost half of all requests to AI platforms came from OpenAI’s API and ChatGPT-relatedchat.com domains, reflecting how these services are consumed.
That concentration is matched by geography. The United States dominates AI traffic, accounting for over 30% of the total in 2025. The UK follows at just under 7%, then Japan, Singapore, and Germany each with roughly 3.4 to 3.5%. The top five countries alone account for nearly half of global AI traffic, a strong indicator that the AI boom is not yet a globally distributed phenomenon.
The common narrative is that AI traffic is growing exponentially, but that framing misses the ecosystem's real dynamics:
- Consumer demand is real but top-heavy. The top ten most-visited autonomous AI agents are overwhelmingly dominated by ChatGPT, with
DeepSeek,Gemini, andClaudefollowing. Beyond those headliners, the list shows a fragmented mix of familiar search engines, coding assistants, and browser-based commerce tools adding AI interfaces. - Worker adoption is larger but not universal. Measuring daily active users across Cloudflare's customer base gives a broader picture: Anthropic’s Claude and Perplexity grab the early worker base, while OpenAI still leads in reach. Notably, roughly one in five accounts that used ChatGPT had also tried major alternatives.
Googlebot’s dual-purpose crawling dwarfed dedicated AI bots in 2025
Cloudflare’s proposal for responsible AI bot principles included the idea that “AI bots should have one distinct purpose and declare it.” In practice, several major operators run dual-purpose crawlers. Googlebot, for instance, crawls both for search engine indexing and AI training, which is why Cloudflare included it in its 2025 AI crawler overview. Its crawl volume was far larger than any dedicated AI bot. Request traffic started climbing in mid-February, peaked in late April, declined slowly through late July, then grew gradually into the end of the year. Bingbot serves a similar dual purpose, though its crawl volume is a fraction of Googlebot’s; its activity trended generally upward over the course of the year.
AI crawler traffic trends in 2025, worldwide
GPTBot, OpenAI’s crawler for content that may be used in training its foundation models, was volatile throughout the year. It reached its highest levels in June but ended November only slightly above where it started. ChatGPT-User, which visits pages when users ask ChatGPT or a CustomGPT questions, showed sustained growth, with a weekly usage pattern becoming clearly visible from mid-February onward — a signal of increasing school and workplace adoption. Peak request volumes hit as much as 16x January’s levels, with a notable dip from June through August when many students were on break. OAI-SearchBot, used to surface websites in ChatGPT search results, grew gradually through August, then saw several traffic spikes in August and September before accelerating into October, when a late-October spike reached roughly 5x the start-of-year volume.
OpenAI crawler traffic trends in 2025, worldwide
Anthropic’s ClaudeBot effectively doubled its crawl volume in the first half of the year but gave much of that back in the second half, ending about 10% higher than January. PerplexityBot crawled slowly through January and February, jumped sharply from mid-March into April, grew more gradually through October, then saw another significant increase in November, winding up roughly 3.5x higher than its starting point. ByteDance’s Bytespider, one of 2024’s top AI crawlers, continued its decline and finished 2025 below several other training bots.
ClaudeBot traffic trends in 2025, worldwide
PerplexityBot traffic trends in 2025, worldwide
User-action crawling grew more than 15x
Most AI bot traffic falls into one of three purposes: training, search, or user action. Training crawls gather content for model training; search crawls index content for AI platform search functionality, which may also include Retrieval-Augmented Generation (RAG); user-action crawls visit sites in response to specific chatbot questions. A fourth “undeclared” bucket captures bots whose purpose is unclear.
Training dominated, reaching as much as 7-8x search crawling and 32x user-action crawling at peak. That figure is heavily influenced by GPTBot and followed a similar trajectory through the year. Search crawling was strongest through mid-March, then dropped by about 40% before returning to gradual growth; it ended the surveyed period just under 10% lower than at the start of the year.
User-action crawling began 2025 with the lowest volume of the three defined purposes, but more than doubled through January and February, doubled again in early March, and continued growing throughout the year — up over 21x from January through early December. That growth closely tracks the traffic pattern of ChatGPT-User.
User action crawler traffic trends in 2025, worldwide
Googlebot alone drove 4.5% of HTML traffic
To understand AI bots’ impact relative to other traffic, Cloudflare analyzed HTML request traffic across its customer base, classifying it as human, AI bot, or other non-AI bot. Because Googlebot is so active and dual-purpose, it was broken out separately. (These shares apply only to HTML content and differ from Radar’s all-content figures.)
AI bots accounted for an average of 4.2% of HTML requests in 2025, ranging from a low of 2.4% in early April to a high of 6.4% in late June. Non-AI bots started the year responsible for half of all HTML requests, seven percentage points above human traffic. That gap widened to as much as 25 points in early June, then began closing in mid-June. Starting September 11, human traffic sometimes exceeded non-AI bots. As of December 2, humans generated 47% of HTML requests, while non-AI bots generated 44%.
Googlebot originated 4.5% of HTML requests over the year — slightly more than all AI bots combined. Its share started just under 2.5%, ramped to 11% by late April, fell back toward its starting point over the following months, and then grew again in the second half, ending at 5%. This mirrors Googlebot’s crawl activity pattern.
HTML traffic shares by bot type in 2025, worldwide
Anthropic posted the highest crawl-to-refer ratio
Radar’s crawl-to-refer ratio metric, launched July 1, tracks how often a platform crawls a site versus how often it sends human traffic to that site. It compares total HTML requests from a platform’s user agents to HTML requests where the Referer header contains a platform hostname. A high ratio means lots of crawling without meaningful referral traffic.
Anthropic had the highest ratios of the year, reaching as much as 500,000:1, though the values were erratic from January through May, likely because its referral traffic was sparse. Ratios became steadier afterward but remained higher than others, ranging from roughly 25,000:1 to 100,000:1. OpenAI’s ratios were extremely spiky, peaking at 3,700:1 in March. These swings may reflect the stabilization of GPTBot crawling alongside increased ChatGPT search usage, which puts links back to source sites in responses and would raise Referer counts, potentially lowering the ratio. Perplexity had the lowest ratios among major AI platforms, starting below 100:1, spiking above 700:1 in late March in line with its crawl spike, then settling below 400:1, and below 200:1 from September onward.
Among search platforms, Microsoft’s ratio unexpectedly followed a weekly cycle, bottoming out on Thursdays and peaking on Sundays, generally in the 50:1 to 70:1 range. Google started just over 3:1, rose steadily to 30:1 by April, then fell erratically to 3:1 by mid-July, and has been slowly increasing since. DuckDuckGo stayed below 1:1 for the first three quarters, then jumped to 1.5:1 in mid-October and stayed elevated.
AI & search platform crawl-to-refer ratios in 2025, worldwide
AI crawlers topped robots.txt disallow lists
Robots.txt, defined by RFC 9309 as the Robots Exclusion Protocol, lets site owners signal which crawlers may access which parts of a site. The directives are advisory, not access control, though Cloudflare’s managed robots.txt can create or update files with AI-specific disallow directives, and its AI Crawl Control can block offending user agents that violate them. Radar offers insight into robots.txt files across the top 10,000 domains, including whether allow and disallow directives apply to the full site or only specified paths (“full” versus “partial”).
AI crawlers — GPTBot, ClaudeBot, and CCBot — received the highest number of fully disallowed directives. Googlebot and Bingbot, which handle both search indexing and AI training, skewed heavily toward partial disallows, likely to cordon off login endpoints and other non-content areas; full-site disallows were a small fraction of their totals.
Robots.txt disallow directives by user agent
Explicit allow directives were far rarer, since allow is the default absent any directive. Googlebot had the most, though over half were partial. Allows targeting AI crawlers appeared across fewer domains, with OpenAI’s crawlers leaning toward explicit full allows. Google-Extended, a token for managing whether crawled content may be used for Gemini training, saw its allow directives triple during the year. Early on, most were partial; by year’s end, full-site allows outnumbered partial ones.
Robots.txt allow directives by user agent
llama-3-8b-instruct led Workers AI, with text generation the top task
Workers AI model popularity metrics, introduced in February 2025, highlight how quickly the provider landscape is evolving. Cloudflare added visibility on Radar into the popularity of publicly available supported models and the types of tasks they perform, based on customer account share, and recently acquired Replicate to broaden its catalog.
Meta’s llama-3-8b-instruct was the dominant model throughout the year, with a 36.3% account share — more than triple the next most popular models. OpenAI’s whisper trailed at 10.1%, followed by Stability AI’s stable-diffusion-xl-base-1.0 at 9.8%. Meta and BAAI each had multiple models in the top 10, which together accounted for 89% of account share, with the remainder spread across a long tail.
Most popular models on Workers AI in 2025, worldwide
Task popularity was driven largely by the top models: text generation, text-to-image, and automatic speech recognition led the list. Text generation was used by 48.2% of Workers AI customer accounts, nearly four times the text-to-image share of 12.3%, with automatic speech recognition close behind at 11.0%.
Most popular tasks on Workers AI in 2025, worldwide
Who’s scanning the web with AI
Beyond the year-to-date traffic aggregates, point-in-time data from October 2025 reveals distinct geographic and industry patterns in AI crawling behavior. These insights go deeper than the global figures highlighted in the Year in Review microsite.
Bot activity by region
Global Year in Review data treats AI bot traffic without regard for where the crawled content owner is based. Narrowing the lens to October 2025 and filtering by the billing region of site owners reveals a consistent leader: Googlebot accounts for 35% to 55% of all crawler traffic in every geographic region.
Two bots compete for second place, each holding a 13–14% share: OpenAI’s GPTBot and Microsoft’s Bingbot. The regional split between them is telling. In mature markets across North America, Europe, and Oceania, Bingbot maintains a comfortable gap over dedicated AI crawlers. But across faster-growing regions in South America and Asia, GPTBot edges out Bingbot, though by a narrower margin.
Geographic region | Top crawlers |
|---|---|
North America | Googlebot (45.5%) |
South America | Googlebot (44.2%) |
Europe | Googlebot (48.6%) |
Asia | Googlebot (39.0%) |
Africa | Googlebot (35.8%) |
Oceania | Googlebot (54.2%) |
Bot activity by industry
Looking at October 2025 crawling figures by customer industry, Retail and Computer Software stand out as the primary targets. Together, these two sectors drew just over 40% of all AI crawler traffic during the month.
The remaining top 10 industries each accounted for far smaller portions of activity. Notably, this top tier contributed just under 70% of total crawling, leaving the residual share distributed across a long tail of other sectors.
iOS gains ground in mobile device traffic
Across 2025, Apple’s iOS accounted for 35% of mobile device traffic globally, up two percentage points from 2024. Android devices still drive the majority of mobile traffic worldwide, a reflection of the broader range of price points, form factors, and capabilities available. Monaco had the highest iOS share at 70%, and iOS generated 50% or more of mobile device traffic in 30 countries and regions, including Denmark (65%), Japan (57%), and Puerto Rico (52%).
Android dominance is even more pronounced in many markets. Twenty-seven countries and regions saw Android usage above 90%, with Papua New Guinea the highest at 97%. Sudan, Malawi, Bangladesh, and Ethiopia all registered at least 95%. Android drove 50% or more of mobile traffic in 175 countries and regions; the Bahamas, at 51%, sat at the bottom of that group.
HTTP adoption holds steady
HTTP/3, which runs over the QUIC transport protocol, has been standardized since 2022. It offers faster connection establishment, better handling of packet loss, and encryption by default. Yet in 2025, distribution of Web requests to Cloudflare remained close to 2024 levels: HTTP/2 accounted for 50% of requests, HTTP/1.x for 29%, and HTTP/3 for 21%, with gains of only fractions of a percentage point.
Geographic adoption of HTTP/3 continued to widen, however. Fifteen countries and regions sent more than a third of their requests over HTTP/3, up from eight in 2024. Georgia led at 38%, barely topping the prior year’s high of 37% in Réunion—though Georgia’s share began the year near 46% before falling through the first half. Armenia posted the largest year-over-year jump, from 25% to 37%. Seven locations remained below 10% HTTP/3 usage, largely due to high volumes of bot-originated HTTP/1.x traffic: Hong Kong, Dominica, Singapore, Ireland, Iran, Seychelles, and Gibraltar.
Web technologies hold mostly steady
Using Cloudflare Radar’s URL Scanner on the top 5,000 domains, jQuery remained the most common JavaScript library, present on eight times as many sites as Slick. React stayed the top framework for building interfaces, found on twice as many scanned sites as Vue.js. PHP, Node.js, and Java continued to lead programming language usage by a wide margin over Ruby, Python, Perl, and C.
WordPress remained the most popular CMS but slipped to 47% of scanned sites, with challengers splitting the difference. HubSpot and Marketo stayed atop the marketing automation category, combining for a 10% higher share year over year. Among A/B testing tools, VWO extended its lead over Optimizely, growing eight percentage points, while Google Optimize—sunsetted in September 2023—fell from 14% to 4%.
Go surges among automated API clients
Examining automated traffic to API endpoints, Go-based clients accounted for 20% of requests in 2025, a notable jump from 12% in 2024. Python also gained, rising from 9.6% to 17%. Java climbed to third place at 11.2%, up from 7.4%. Node.js, second in 2024, dropped to 8.3% and fourth place, while .NET rounded out the top five at 2.3%.
Search and browser standings
Measuring referral traffic from the HTTP referer header, Google maintained its commanding lead, referring nearly 90% of traffic to Cloudflare-protected sites in 2025. It was followed by Bing (3.1%), Yandex (2.0%), Baidu (1.4%), and DuckDuckGo (1.2%). Yandex’s share dipped from 2.5% in May to 1.5% in July, while Baidu rose from 0.9% in April to 1.6% in June.
Regional patterns diverge. In Russia, Yandex holds a 65% market share, nearly double Google’s 34%. In the Czech Republic, Google leads at 84%, but local engine Seznam’s 7.7% share stands out. Across Windows-based desktop traffic, Google’s share drops to roughly 80% and Bing climbs to nearly 11%—likely reflecting that on Windows systems, Chrome refers just 76% of traffic to Bing’s 14%. From mobile devices, Google holds roughly 93% of the market, a figure consistent across both Android and iOS.
Browser shares, measured via User-Agent and Client Hints headers, show Chrome at two-thirds of global request traffic in 2025. Safari followed at 15.4%, ahead of Microsoft Edge (7.4%), Mozilla Firefox (3.7%), and Samsung Internet (2.3%).
Russia again stands apart: Chrome leads with 44%, while Yandex Browser holds a strong 33% share. Yandex Browser briefly overtook Chrome in June—39% to 38%—before losing ground through the rest of the year. On iOS, Safari dominates with 79% of requests, four times Chrome’s 19%. On Android, Chrome accounts for 85%, with Samsung Internet at 6.6% and Huawei Browser at 1%. On Windows, Chrome takes 69% of traffic to Edge’s 19%.
Government-Directed Shutdowns Dominated 2025 Outages
Internet outages continue to pose a growing threat, with the potential for significant economic losses, disruption of educational and government services, and limited communications. In 2025, the Cloudflare Radar Outage Center tracked 174 major outages worldwide. Nearly half of these were government-directed shutdowns, many of which were implemented to prevent cheating during academic exams. Countries including Iraq, Syria, and Sudan enforced regular multi-hour shutdowns over several weeks during exam periods. Other government-directed actions in Libya and Tanzania were responses to protests and civil unrest, while in Afghanistan, the Taliban ordered a shutdown of fiber optic connectivity in multiple provinces in an effort to “prevent immorality.”
Cable cuts, affecting both submarine and domestic fiber optic infrastructure, were another leading cause of disruptions. These cuts impacted network providers in the United States, South Africa, Haiti, Pakistan, and Hong Kong, with service disruptions lasting from several hours to several days. Other notable outages included a fire in a telecom building in Cairo, Egypt, which disrupted connectivity for several days, and damage caused by Hurricane Melissa in Jamaica, which resulted in lower Internet traffic for over a week.
Globally, less than a third of dual-stack requests were made over IPv6 in 2025. The aggregate data shows that 29% of IPv6-capable requests for content were made over IPv6, up from 28% in 2024. India again led the world with an adoption rate of 67%, followed by Malaysia, Saudi Arabia, and Uruguay—the only other countries/regions to make more than half of such requests over IPv6. The largest gains were seen in Belize, which grew from 4.3% to 24%, and Qatar, which nearly doubled to 33%. However, 94 countries/regions still have adoption rates below 10%, including Russia (8.6%), Ireland (6.5%), and Hong Kong (3.0%). Twenty countries/regions remain below 1%.
European Countries Dominate Speed Metrics
Analysis of tests taken on speed.cloudflare.com during 2025 offers a country/region perspective on average connection quality. Europe was well-represented among those with the highest average download speeds. Spain, Hungary, Portugal, Denmark, Romania, and France were all in the top 10, with both Spain and Hungary averaging download speeds above 300 Mbps. Spain’s average grew by 25 Mbps from 2024, while Hungary’s jumped 46 Mbps. Asian countries had many of the highest average upload speeds, with South Korea, Macau, Singapore, and Japan reaching the top 10, all seeing averages in excess of 130 Mbps.
Spain topped the list for the upload metric as well, at 206 Mbps, up 13 Mbps from 2024. The country’s strong showing across both speed metrics is potentially attributable to “UNICO-Broadband,” a call for projects by telecommunications operators aimed at deploying high-speed broadband infrastructure capable of providing services at symmetric speeds of at least 300 Mbps.
For latency, European countries also ranked among those with the lowest idle and loaded latencies. For average idle latency, Iceland measured the lowest at 13 ms, just 2 ms better than Moldova. Portugal, Spain, and Hungary also ranked among the top 10, all with average idle latencies below 20 ms. Moldova topped the list for the lowest average loaded latency at 73 ms, with Hungary, Spain, Belgium, Portugal, Slovakia, and Slovenia also in the top 10, all with averages below 100 ms.
A new animated Year in Review visualization illustrates speed test activity, aggregated weekly at a regional level. The greater London and Los Angeles areas were the most active, as were Tokyo, Hong Kong, and several U.S. cities. Week-over-week surges in test volume were visible in the Nairobi, Kenya, area during the period ending June 10; the Tehran, Iran, area for the period ending July 29; across multiple areas in Russia for the period ending August 5; and in the Karnataka, India, area for the period ending October 28. The Cloudflare Radar Outage Center does not show any observed Internet outages impacting those areas around those times, so it is unlikely these surges were subscribers testing the restoration of connectivity.
Mobile Traffic Holds at a “Steady State”
Information contained within the User-Agent header included with each request to Cloudflare enables categorization of the traffic as coming from a mobile, desktop, or other type of device. Aggregating this data globally across 2025 found that 43% of requests were from mobile devices, up from 41% in 2024. These traffic shares are in line with those measured in Year in Review reports dating back to 2022, suggesting that mobile device usage has achieved a “steady state.”
In 117 countries/regions, more than half of requests came from mobile devices, led by Sudan and Malawi at 75% and 74%, respectively. Five other African countries/regions—Eswatini (Swaziland), Yemen, Botswana, Mozambique, and Somalia—also had mobile request shares above 70%. Gibraltar was the only country/region below 10%, at 5.1%, with just six others originating less than a quarter of requests from mobile devices. This is fewer than in 2024, when a dozen countries/regions had a mobile share below 25%.
Mitigated traffic share edges down in 2025
Cloudflare’s automated defenses — spanning DDoS mitigation and WAF Managed Rules — blocked or acted on 6.2% of global traffic traversing its network in 2025, a 0.25 percentage point dip from the prior year. The subset mitigated specifically as DDoS attacks or via managed rules rose one-tenth of a point to 3.3%. More than 30 countries/regions saw general mitigations applied to over 10% of their traffic, while 14 exceeded that threshold for DDoS/WAF mitigations — both counts down from 2024.
Equatorial Guinea led all locations, with 40% of its traffic generally mitigated (up from 26% in 2024) and 29% subject to DDoS/WAF actions. Dominica sat at the opposite extreme, with only 0.7% of traffic mitigated overall and 0.1% from DDoS/WAF rules. A sharp spike in mitigated traffic in July traces to a large DDoS campaign aimed primarily at a single customer domain.
Mitigated traffic trends in 2025, worldwide
US dominates bot traffic origins; AWS, Google Cloud lead networks
Cloudflare’s bot detection heuristics score each request on the likelihood it comes from an automated client rather than a human. Grouping suspected bot requests by source autonomous system and country/region, the top 10 origins accounted for 71% of observed bot traffic. The United States alone produced 40%, up over five percentage points from 2024, with Germany a distant second at 6.5%; no other country/region exceeded 5%.
Global bot traffic distribution by source country/region in 2025
Cloud platforms continued to be outsized bot sources, helped by cheap, easily provisioned compute and high-bandwidth connectivity. Two autonomous systems tied to Amazon Web Services generated 14.4% of bot traffic combined, two tied to Google Cloud produced 9.7%, and Microsoft Azure added 5.5% — all up year over year. In most countries/regions outside the top 10, local telecommunications providers were the leading bot originators.
Global bot traffic distribution by source network in 2025
People and Society vertical draws heaviest attack traffic
Aggregating mitigated traffic by customer industry across 17 verticals, organizations in the "People and Society" category — religious institutions, nonprofits, civic groups, and libraries — were the most targeted of 2025, absorbing 4.4% of global mitigated traffic. The vertical began the year at under 2%, jumped to 10% during the week of March 5, and surpassed 17% by month’s end. Additional surges hit 19.1% in late April and 23.2% in early July. Many such organizations are protected under Cloudflare’s Project Galileo.
Gambling/Games, last year's most-attacked vertical, saw its share fall by half to 2.6%. Its peak of 6.5% came the week of March 5 — a month after the Super Bowl and before March Madness — showing no clear tie to major sporting events.
Global mitigated traffic share by vertical in 2025, summary view
RPKI adoption keeps climbing
BGP relies on trust between peers, so incorrect announcements can redirect traffic, sometimes to attacker-controlled systems. Resource Public Key Infrastructure (RPKI) cryptographically binds a route announcement to its authorized originating autonomous system, and Cloudflare tracks adoption via its Radar Routing page.
Valid IPv4 routes grew from 50% at the start of 2025 to 53.9% by December 2, while valid IPv6 routes reached 60.1%, up 4.7 points. By address space coverage, IPv4 climbed three points to 48.5%, while IPv6 dipped slightly to 61.6%. Annual growth is slowing, but since the start of 2020 both valid IPv4 routes and IPv4 space coverage have roughly tripled.
Shares of global RPKI valid routing entries by IP version in 2025
Shares of globally announced IP address space covered by RPKI valid routes in 2025
Barbados saw the largest IPv4 improvement, lifting valid routes from 2.2% to 20.8% and valid-route-covered space from 2.0% to 18.6%. For IPv6, Mali’s valid route share grew from 10.0% to 58.3%, while Tajikistan and Dominica went from effectively no valid-route-covered space to 5.5% and 3.5%, respectively.
Hyper-volumetric DDoS attacks break records
Cloudflare defines a hyper-volumetric network layer attack as a Layer 3/4 assault peaking above 1 Tbps or 1 billion packets per second (Bpps). Monthly tallies in 2025 varied widely on the volumetric side: over 500 attacks peaked above 1 Tbps in July, the busiest month, versus just over 150 in February, the quietest.
Attack intensity mostly stayed below 5 Tbps through August, but a 10 Tbps attack blocked late that month signaled an escalation. A campaign of >10 Tbps attacks followed in early September, giving way to >20 Tbps attacks in the last week of the month. October brought increasingly larger peaks, topping out at 29.7 Tbps, before an early November attack reached 31.4 Tbps.
On the packets-per-second axis, hyper-volumetric events were rarer. November saw over 140 — the most — while February and June each saw just three through most of the year. Intensity generally stayed below 4 Bpps until late August, when a series of escalating attacks began, peaking in October. That month included a 14 Bpps attack, the largest of the year, which bested five successive record-setters from September.
Peak DDoS attack sizes in 2025
Email: the persistent attack surface
Email remains a primary entry point for attackers despite the growth of collaboration apps. Generative AI has lowered the barrier to crafting targeted malicious messages that impersonate trusted brands or executives. In 2025, Cloudflare Email Security found an average of 5.6% of analyzed messages to be malicious. The share fluctuated between 4% and 6% for most of the year, with a visible increase starting in October — likely the result of an improved classification system.
Threat categories: links dominate, impersonation grows
Deceptive links were the top malicious email threat category in 2025, appearing in 52% of malicious messages — up from 43% in 2024. Attackers exploit the fact that HTML hyperlink display text can be arbitrarily set, making a URL appear benign while actually linking to a credential-harvesting or malware-delivering resource. The share of processed emails containing deceptive links peaked at 70% in late April and again in mid-November.
Identity deception, where an attacker claims to be someone else via similar, spoofed or lookalike domains, was found in 38% of malicious email — up from 35% in 2024. Brand impersonation, a subset using recognizable company names, rose from 23% to 32%. Both categories saw an uptick in mid-November.
Email threat category trends in 2025, worldwide
Top-Level Domains with the worst reputations
Cloudflare Radar tracks "most abused" TLDs based on the share of malicious and spam email originating from domains using them, using the sending domain from the message's From: header. For this analysis, only TLDs with an average minimum of 30 messages per hour were included.
Across all 2025 messages, .christmas and .lol were the most abused: 99.8% and 99.6% of messages from these TLDs were spam or malicious, respectively. Sorting by malicious share alone, .cfd and .sbs both had over 90% of analyzed emails categorized as malicious. For pure spam, .best led with 69% of messages flagged.
TLDs originating the largest total shares of malicious and spam email in 2025
Outlook
While core Internet metrics have become relatively stable, AI-related trends are expected to shift rapidly as the space evolves. Full country and region-level data, along with near real-time metrics, is available on the Cloudflare Radar 2025 Year In Review microsite and Cloudflare Radar. The companion post covering top Internet services across industry categories is also available for further reading.
