Internet Rewired: Cloudflare 2025 Report Reveals a 19% Traffic Surge and the Rise of AI Bot Wars
By the end of 2025, the internet had become even more tightly bound to cloud infrastructure, mobile traffic, and automation, with protective mechanisms increasingly operating “by default” within large content delivery networks. In its Cloudflare Radar 2025 report, Cloudflare assembled a portrait of the year based on data drawn from its global infrastructure and the 1.1.1.1 DNS resolver.
According to the company, global internet traffic grew by 19%. Google retained its position as the most popular online service, while Facebook, Apple, Microsoft, Instagram, AWS, YouTube, TikTok, Amazon, and WhatsApp rounded out the top ten. Notably, generative AI in 2025 ceased to be a single, monolithic platform: ChatGPT now faces credible competitors such as Claude, Perplexity, and Gemini, a shift that is already reshaping query patterns and bot activity.
Automated traffic emerged as one of the defining themes of the year. Among verified bots, Googlebot generated the highest volume of requests, while in the AI crawler segment the dominant purpose was model training. Cloudflare identified 3,879 robots.txt files across the top 10,000 domains that explicitly reference AI crawlers in Allow and Disallow rules. AI bots accounted for 4.2% of HTML requests, with Googlebot contributing an additional 4.5%, compared with 43.5% attributed to human traffic.
In cryptography, a clear pivot toward future resilience is evident: 52% of TLS 1.3 traffic traversing Cloudflare’s network used post-quantum cryptography for key exchange. The company attributes this growth largely to broader browser support for such mechanisms.
At the protocol and device level, Cloudflare recorded 35% of traffic originating from iOS devices and 21% of requests using HTTP/3. In automated API traffic, Go emerged as the most popular client-side implementation language, accounting for 20%. The report also highlights the rapid expansion of Starlink: SpaceX’s satellite internet traffic grew 2.3× year over year, underscoring the growing importance of alternative connectivity for remote regions.
In terms of infrastructure resilience, Cloudflare logged 174 major network outages worldwide. Dual-stack IPv6 traffic reached 29%. According to speed.cloudflare.com, Spain stood out for the highest average download speeds, while the greatest number of speed tests were conducted in the London area.
The security section is particularly dense: 6.2% of global traffic observed by Cloudflare was blocked or filtered by defensive systems, and the peak of a recorded network-layer DDoS attack reached 31 Tbps.
In routing, the share of RPKI-valid routes continued to rise, gradually reducing the scope for certain BGP manipulations. In email traffic, 5.6% of messages were classified as malicious, with deceptive links appearing in 52% of those emails. Among top-level domains most frequently associated with spam by year’s end, “.christmas” ranked first.
The internet increasingly resembles a system in which speed and convenience are born of automation, while risks expand alongside it. Resilience now depends not on a single elegant solution, but on disciplined configuration, transparent rules for machine traffic, and an acceptance of failure as a normal operating condition rather than an exception.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
