2025 Internet Trends Review: The Rise of AI, Post-Quantum Encryption, and Record-Breaking DDoS Attacks

Abstract

2025 witnessed pivotal shifts in the global internet landscape: 19% growth in global traffic, a surge in AI crawler activity, doubled traffic for Starlink (expanding to over 20 new countries), 52% of human-generated traffic using post-quantum encryption, and significant expansion in hyper-volumetric DDoS attack sizes—all shaping the year’s digital trajectory.

In 2025, Cloudflare released its sixth annual Internet Trends Review, leveraging data from its global network spanning 330 cities across 125+ countries/regions. The network processes an average of 81 million HTTP requests per second (peaking at 129 million) and approximately 67 million DNS queries per second. Beyond real-time insights, the review offers interactive charts and maps to unpack the year’s most impactful digital changes. Let’s dive into the key trends that defined the internet in 2025.

I. Key Findings: Core Shifts in 2025’s Internet Ecosystem

2025’s internet evolution was marked by rapid iteration and multi-faceted breakthroughs—from traffic growth and AI adoption to connectivity advancements and cybersecurity challenges. Below are the standout developments across critical domains:

Traffic Dynamics

• Global internet traffic rose by 19%, with accelerated growth starting in August.
• The top 10 most popular internet services saw year-over-year ranking shifts, while new entrants emerged in category-specific lists.
• Starlink’s traffic doubled in 2025, expanding its reach to over 20 new countries/regions.
• Googlebot retained its position as the top source of request traffic to Cloudflare, crawling millions of customer sites for search indexing and AI training.
• Post-quantum encrypted traffic accounted for 52% of human-generated web traffic.
• Googlebot drove over a quarter (28%+) of verified bot traffic.

AI Developments

• Crawl volume from dual-purpose Googlebot (serving search indexing and AI training) far outpaced other AI bots and crawlers.
• AI “user action” crawling surged by over 15x in 2025.
• While other AI bots accounted for 4.2% of HTML request traffic, Googlebot alone contributed 4.5%.
• Anthropic maintained the highest crawl-to-refer ratio among leading AI and search platforms.
• AI crawlers were the most frequently fully disallowed user agents in robots.txt files.
• On Workers AI, Meta’s llama-3-8b-instruct model was the most popular, with text generation as the top task type.

Adoption & Usage Patterns

• iOS devices generated 35% of global mobile traffic—and over half of device traffic in many countries.
• Adoption of HTTP/3 and HTTP/2 for global web requests saw slight year-over-year increases.
• JavaScript-based libraries and frameworks remained integral to website development.
• One-fifth of automated API requests originated from Go-based clients.
• Google retained its lead as the top search engine, with Yandex, Bing, and DuckDuckGo as distant followers.
• Chrome remained the dominant browser across platforms—except on iOS, where Safari held the largest market share.

Connectivity Insights

• Nearly half of the 174 major internet outages worldwide in 2025 stemmed from government-directed regional or national connectivity shutdowns.
• Globally, less than a third of dual-stack requests used IPv6, while India led with over two-thirds (67%).
• European countries boasted some of the highest download speeds (all above 200 Mbps), with Spain consistently ranking among top performers across internet quality metrics.
• London and Los Angeles emerged as hotspots for Cloudflare speed test activity in 2025.
• Mobile devices accounted for over half of request traffic in 117 countries/regions.

Cybersecurity Trends

• 6% of global traffic on Cloudflare’s network was mitigated—either as potentially malicious or due to customer-defined policies.
• 40% of global bot traffic originated from the U.S., with Amazon Web Services (AWS) and Google Cloud collectively accounting for a quarter of global bot traffic.
• Organizations in the “People and Society” sector were the most targeted by cyberattacks in 2025.
• Routing security (measured by RPKI valid routes and covered IP address space) continued to improve throughout the year.
• Hyper-volumetric DDoS attack sizes grew significantly across 2025.
• Over 5% of emails analyzed by Cloudflare were identified as malicious.
• Deceptive links, identity deception, and brand impersonation were the most common threats in malicious emails.
• Nearly all emails from the .christmas and .lol top-level domains (TLDs) were classified as spam or malicious.

II. Traffic Trends: Growth, Shifts, and Emerging Players

Global Internet Traffic Grows 19%—Accelerating in August

2025’s traffic growth unfolded in distinct phases, with the baseline set as the average daily traffic (excluding bot traffic) during the second full calendar week of January (January 12–18)—chosen to avoid post-holiday disruptions.

Traffic remained relatively stable through mid-April, fluctuating within a few percentage points of the baseline. It then grew to 5% above baseline by May, staying in the +4–7% range until mid-August. From there, growth accelerated steadily through September, October, and November, peaking at 19% for the year—10% higher than 2024’s 17% growth. Notably, while 2022–2024’s acceleration began in July, 2025’s shift was delayed by several weeks, with no clear cause identified.

Botswana recorded the most dramatic growth, reaching 298% above baseline on November 8 and ending the year at 295%. Alongside Sudan, it was one of only two countries/regions to see traffic more than double annually, though other regions experienced peak increases exceeding 100% at various points.

Top Internet Services See Rank Shifts—New Entrants Emerge

We analyzed 11 months of anonymized DNS query data to rank internet services globally and across nine categories (grouping domains belonging to the same service).

Google and Facebook retained the top two spots overall. While the remaining top 10 services stayed consistent with 2024, mid-rank movements occurred: Microsoft, Instagram, and YouTube climbed higher; AWS dropped one position; and TikTok fell four spots.

In generative AI, ChatGPT/OpenAI maintained its lead, but the sector remained dynamic. Perplexity, Claude/Anthropic, and GitHub Copilot rose in rankings, while Google Gemini, Windsurf AI, Grok/xAI, and DeepSeek entered the top 10 as new entrants.

Other categories also saw changes: Shopee (a leading e-commerce platform in Southeast Asia and Taiwan) joined the E-Commerce list, and HBO Max entered the Video Streaming rankings. For the first time, we also provide country/region-specific insights for top services in Overall, Generative AI, Social Media, and Messaging categories (up from only Overall insights in 2024).

Starlink Traffic Doubles—Rapid Expansion in New Markets

SpaceX’s Starlink satellite internet service continued to gain traction in 2025, with request traffic from its primary autonomous system (AS14593) growing 2.3x year-over-year.

Starlink’s traffic surges sharply when launching in new markets—a trend that persisted in 2025. The service expanded to over 20 new countries/regions, including Armenia, Niger, Sri Lanka, and Sint Maarten, with immediate traffic spikes in each.

We also detected Starlink traffic in regions not marked as service-available. This is likely due to roaming users, as these areas have corresponding IPv4/IPv6 prefixes in Starlink’s published geofeed.

Among countries with pre-2025 Starlink availability, Benin, Timor-Leste, and Botswana saw the largest growth—51x, 19x, and 16x respectively. Starlink launched in Benin (November 2023), Timor-Leste (December 2024), and Botswana (August 2024).

Competing satellite services like Amazon Leo, Eutelsat Konnect, and China’s Qianfan are expanding their constellations and moving toward commercial availability—we will monitor their traffic growth in future reports.

Googlebot Leads Request Traffic for Third Consecutive Year

Using a Hilbert curve (a 2D visualization tool for IPv4 address sequences), we analyzed request traffic to Cloudflare from the global IPv4 internet. Google’s 66.249.64.0/20 address block—one of several used by Googlebot for search indexing and AI training—claimed the top spot for the third year running.

This block’s IPv4 request volume was nearly 4x that of the second-largest source (Rackspace Hosting’s 146.20.240.0/20). Googlebot’s dominance is unsurprising given Cloudflare’s extensive customer base and the crawler’s aggressive activity.

In 2025, we added ASN (Autonomous System Number) search functionality to the visualization. For example, AS16509 (Amazon AWS) reflects Amazon’s years of IPv4 address acquisitions, while AS7018 (AT&T) —one of the largest IPv4 announcers in the U.S.—generates significant traffic from the 12.0.0.0/8 block (owned by AT&T since 1983).

Post-Quantum Encryption Reaches 52% of Human Traffic

Post-quantum cryptography protects data from “harvest now, decrypt later” attacks—where adversaries store current data to decrypt with future quantum computers. Cloudflare’s research team has focused on this technology since 2017.

Following significant growth in 2024, post-quantum encrypted traffic nearly doubled in 2025, rising from 29% in January to 52% in early December.

Twenty-eight countries/regions saw their post-quantum encryption share more than double. Puerto Rico grew from 20% to 49%, while Kuwait nearly tripled its share (13% to 37%).

This surge aligns with Apple’s September operating system update, which enabled “TLS-protected connections to automatically advertise support for hybrid, quantum-secure key exchange in TLS 1.3.” In Kuwait and Puerto Rico—where over half of traffic comes from mobile devices, and ~50% from iOS—this update drove substantial growth.

After iOS 26’s release, post-quantum encryption for iOS requests jumped from under 2% to 11% in four days. By early December, over 25% of iOS requests used post-quantum encryption.

Googlebot Drives Over 25% of Verified Bot Traffic

Cloudflare Radar’s new Bots Directory provides details on verified bots and signed agents—including operators, categories, user agents, and traffic trends. Verified bots must meet strict requirements and pass Web Bot Auth or IP validation.

Googlebot (used for search indexing and AI training) was the most active bot in 2025, peaking in mid-April and accounting for over 28% of verified bot traffic. Other Google bots—Google AdsBot (monitoring ad-hosting sites), Google Image Proxy (caching email images), and GoogleOther (fetching public content)—also generated significant traffic.

OpenAI’s GPTBot (for AI training) ranked second with 7.5% of verified bot traffic, showing volatile activity in H1 2025. Microsoft’s Bingbot (search indexing and AI training) contributed 6% with stable activity.

Search engine crawlers (40%) and AI crawlers (20%) were the top verified bot categories, followed by search engine optimization bots (13%).

III. AI Insights: Crawler Activity and Technological Adoption

Dual-Purpose Googlebot Outpaces Other AI Crawlers

In September 2025, Cloudflare proposed principles for responsible AI bots—including “AI bots should have one distinct purpose and declare it.” However, Radar’s AI bot best practices note that some operators (e.g., Google, Microsoft) use dual-purpose crawlers.

Given Googlebot’s role in both search indexing and AI training, it was included in our 2025 AI crawler analysis. Its crawl volume far exceeded other leading AI bots: traffic rose in mid-February, peaked in late April, declined through late July, and then gradually grew through year-end.

Bingbot (also dual-purpose) saw steady upward trends but with a fraction of Googlebot’s volume.

OpenAI’s GPTBot (for training foundation models) showed volatile activity, peaking in June and ending November slightly above January levels.

ChatGPT-User (visiting pages in response to user queries) saw sustained growth, with a weekly usage pattern emerging in mid-February (suggesting workplace/school adoption). Peak traffic was 16x higher than January, with a lull in June–August (likely due to holidays).

OAI-SearchBot (linking websites in ChatGPT search results) grew gradually through August, spiked in August–September, and accelerated in October—with late-October peak traffic 5x higher than January.

Anthropic’s ClaudeBot doubled its crawl volume in H1 2025 but declined in H2, ending 10% above January levels. PerplexityBot grew slowly in January–February, surged in mid-March–April, and expanded again in November—finishing 3.5x higher than the start of the year.

ByteDance’s Bytespider (a top 2024 AI crawler) saw reduced volume in 2025, continuing its 2024 decline.

AI “User Action” Crawling Surges 15x+

AI bot crawling serves three primary purposes:

1. Training: Gathering content for AI model training (dominant, peaking at 7–8x search crawling and 32x user action crawling).
2. Search: Indexing content for AI platform search (including RAG for LLM generation without retraining).
3. User action: Visiting sites in response to chatbot user queries (lowest at the start of 2025 but fastest-growing).

Search crawling peaked in mid-March (dropping 40%), then grew gradually but ended 10% below January levels.

User action crawling started as the smallest category but doubled in January–February, doubled again in early March, and grew 21x by early December—closely mirroring ChatGPT-User’s traffic trends.

Googlebot Alone Drives More HTML Traffic Than All Other AI Bots Combined

AI bots have sparked concerns among content owners due to high traffic volumes that often fail to drive user referrals. To assess their impact, we analyzed HTML request traffic (focusing on human, AI bot, and non-AI bot sources).

In 2025, AI bots accounted for an average of 4.2% of HTML requests—ranging from 2.4% (early April) to 6.4% (late June).

Non-AI bots started the year with 50% of HTML requests (7 percentage points above humans), widening to a 25-point gap in early June. However, shares converged in mid-June, with human traffic occasionally exceeding non-AI bots after September 11. As of December 2, humans generated 47% of HTML requests, and non-AI bots 44%.

Googlebot alone drove 4.5% of HTML requests—slightly more than all other AI bots combined. Its share rose from under 2.5% in January to 11% (late April), declined through mid-year, and grew again in H2 to 5% by December.

IV. Frequently Asked Questions (FAQ)

Q: How much did global internet traffic grow in 2025?
A: Global internet traffic increased by 19% in 2025, with accelerated growth starting in August.

Q: Which AI services stood out in the generative AI category in 2025?
A: ChatGPT/OpenAI retained the top spot. Perplexity, Claude/Anthropic, and GitHub Copilot rose in rankings, while Google Gemini, Windsurf AI, Grok/xAI, and DeepSeek were new entrants to the top 10.

Q: What key developments did Starlink see in 2025?
A: Starlink’s traffic grew 2.3x year-over-year, expanding to over 20 new countries/regions. In existing markets, Benin (51x), Timor-Leste (19x), and Botswana (16x) recorded the largest growth.

Q: How widely adopted was post-quantum encryption in 2025?
A: Post-quantum encryption accounted for 52% of human-generated global traffic. Twenty-eight countries/regions saw their adoption double, with Apple’s iOS 26 update driving significant growth.

Q: Which bot drove the most verified bot traffic in 2025?
A: Googlebot led with over 28% of verified bot traffic, followed by OpenAI’s GPTBot (7.5%) and Microsoft’s Bingbot (6%).

2025’s internet was defined by rapid innovation and evolving challenges—from AI’s growing influence and connectivity advancements to emerging cybersecurity threats. To explore region-specific trends or dive deeper into data, visit the 2025 Cloudflare Radar Year in Review microsite. Whether you’re an organization planning for 2026 or a digital enthusiast tracking industry shifts, these insights offer a comprehensive view of the internet’s current state and future trajectory.