Threat observations

DDoS Activity Observation · not scored

Distributed denial-of-service activity as observed and mitigated across Cloudflare’s network — one provider’s view, not a global Internet total. Application-layer and network-layer attacks are kept separate. Not included in the headline ICHI.

Last updated——

DDoS activity map

Provider-observed activity (not included in ICHI)

HighElevated ModerateLow Activity flow

Loading the DDoS observation…

Source & scope

Provider-observed: what Cloudflare saw and mitigated across its own network. Not a global Internet total, not attack counts, not victim numbers.
Trends are relative (indices and shares, not volumes or bit rates). Application-layer and network-layer values are never added together.
Arcs are country-level representations, never network routes. Origin is where attack traffic was observed coming from — not the attacker’s nationality.
No network, organisation, ASN or IP address is shown. Observation only — not part of the ICHI score.
Botnet infrastructure is a second, separate source: indicators the community reported to abuse.ch ThreatFox for DDoS-botnet families. It measures infrastructure, not attacks, and is never combined with Cloudflare’s activity figures.
Threat reports are listed as the publisher wrote them — title, date and link only. ICHI does not measure or verify them, and nothing from them enters any number on this page.
Other public views, linked for reference and not used as data: NETSCOUT Cyber Threat Horizon · Shadowserver Dashboard.
Data from Cloudflare Radar (radar.cloudflare.com), CC BY-NC 4.0.

ⓘ DDoS activity is an operational observation and not included in the ICHI score. One provider’s view; updated daily; may be incomplete.Methodology