Cloudflare reveals AI surge & Internet ‘bot wars’ in 2025
Cloudflare has reported a sharp rise in global Internet traffic and a surge in AI-related activity in its latest annual review of online trends.
The company said worldwide Internet traffic grew 19% over the past year. It also reported rapid adoption of post-quantum encryption and a shift in cyber attacks towards civil society organisations.
Cloudflare operates a large global network and handles a significant share of global Internet requests. Its data is based on traffic flowing through this network and usage of its 1.1.1.1 public DNS resolver.
The company said post-quantum encryption now protects 52% of all human web traffic. This marks one of the first large-scale deployments of cryptography designed to resist future quantum computers.
Cloudflare also highlighted a series of record-breaking distributed denial of service attacks during the year. The company said it had seen more than 25 DDoS incidents that surpassed earlier traffic peaks on its network.
“The Internet isn't just changing, it's being fundamentally rewired. From AI, to more creative and sophisticated threat actors, everyday is different. While we celebrated several Internet milestones this year, we also blocked attacks that redefined what 'scale' means, and witnessed the traditional business model of online content creation face stark challenges,” said Matthew Prince, CEO and co-founder, Cloudflare. “With a huge percentage of the Internet running through Cloudflare's network every second of every day, we believe we have a unique responsibility to help navigate these changes and build a better Internet for everyone.”
AI model race
Cloudflare reported that use of AI models and AI crawling activity increased sharply. It said crawling for model training accounted for the majority of AI crawler traffic during the year.
Training-related crawlers generated traffic that reached as much as seven to eight times the level of retrieval-augmented generation and search crawlers at peak. Traffic from training crawlers was also as much as 25 times higher than AI crawlers tied to direct user actions.
The company said Meta’s llama-3-8b-instruct model was the most widely used on its network. It was used by more than three times as many accounts as the next most popular models from providers such as OpenAI and Stability AI.
Cloudflare added that Google’s crawling bot remained the dominant automated actor on the Internet. It said Googlebot’s crawl volume exceeded that of all other leading AI bots by a wide margin and was the largest single source of automated traffic it observed.
The report also described volatile behaviour by OpenAI’s GPTBot. Peak request volumes from the crawler rose to as much as 15 times the levels seen at the start of the year.
Cloudflare said Anthropic’s ClaudeBot doubled its crawling activity during the first half of the year. The company then saw a gradual decline in ClaudeBot traffic in the second half.
Perplexity’s PerplexityBot also recorded strong growth. Cloudflare said its crawling volumes jumped in mid-March into April and again in November. By the end of the period, traffic was around five times higher than at the beginning of the year.
The company reported a different pattern for ByteDance’s Bytespider crawler. It said Bytespider, which it described as one of 2024’s top AI crawlers, showed a noticeable decline compared with other training bots and on a year-on-year basis.
Bot traffic shifts
Cloudflare described 2025 as a year of intensifying “bot wars” across the Internet. It said AI-related crawlers, search engines and more traditional scraping tools now make up a substantial part of traffic seen on many sites.
Data from its network showed Google and Meta maintaining their positions as the most popular Internet services globally. Google and Facebook, now part of Meta, led overall web traffic for the fourth year in a row.
In the generative AI category, ChatGPT remained the most visited service worldwide. Cloudflare said this ranking came from aggregated traffic patterns across its network.
New attack targets
Cloudflare reported a notable shift in the sectors that face the highest volume of cyber attacks. Civil society and non-profit organisations became the most attacked group for the first time.
The company linked this trend to the sensitivity and financial value of the data held by such organisations. This includes personal information about donors, volunteers and beneficiaries.
Cloudflare’s data also showed changes in the causes of major Internet outages. Nearly half of serious disruptions worldwide were associated with actions by governments. These included shutdown orders, content restrictions and network-level interventions.
At the same time, outages caused by physical cable cuts decreased by almost 50%. Disruptions linked to power failures doubled over the same period.
European lead on speed
The report found that European countries led global rankings for Internet speed and quality. Several markets in the region recorded average download speeds above 200 Mbps.
Spain ranked first globally on Cloudflare’s overall Internet quality index. The measure combines speed, reliability and other performance indicators.
Cloudflare said all of the findings came from its Radar observability platform. Radar aggregates and anonymises data from the company’s network and its DNS resolver service.
The firm plans to continue publishing Radar-based analyses of AI usage, security incidents and connectivity trends over the coming year.
