Where does attack traffic flow? 24 hours of Cloudflare Radar data

All values in this report come from Cloudflare Radar’s public “top attack pairs” data. Values show the percentage share of total mitigated attack traffic in the period. The live globe on our home page uses the same source.

The United States is by far the most targeted country for web attacks: routes targeting it make up roughly 36.5% among the top 40. Data-center-dense countries such as Singapore and the Netherlands leading on the origin side suggests attack infrastructure runs largely on rented servers.

Network-layer DDoS looks different: about 33 points of the top 40 routes target Hong Kong. South American countries leading on the origin side is consistent with the density of compromised devices and home networks there.

Traffic originating in Türkiye appears in the same dataset: 0.74% of L7 traffic toward the United States and 0.42% of L3 traffic toward Hong Kong. L3 traffic from Azerbaijan (0.47%) is also among the top 40. Compromised devices in the region are being used as part of global attack infrastructure.

• Monitor anomalous traffic leaving your own IP ranges — a compromised server may be attacking someone else.
• Protect web applications with rate limiting and bot management.
• Validate your DDoS resilience with controlled tests: DDoS & WAF Security.