Glossary (12)

Last updated Oct 12, 2026 This page provides a list of terms and concepts to help you understand Radar and the information shown.

AI bot and crawler traffic

HTTP request activity from user agents associated with AI assistants, AI data scrapers, and AI search crawlers. This information is normalized to show trends in traffic volume, providing insights into the activity levels of AI-driven web interactions over time. User agents included in this analysis are derived from the AI-focused user agents listed in the ai.robots.txt ↗︎ repository.

Application-level attacks

Layer 7 attack information based on mitigated requests, including the most frequent mitigation techniques as well as the trend of mitigated request volume over time. For the "Application layer attack volume" and "Mitigated traffic sources" graphs, the selected location or ASN is the source of the mitigated requests. For the "Application layer attack distribution" graph, the Origin Location graph shows where attacks targeting the selected location are coming from and the Target Location graph shows the target locations of attacks coming from the selected location. "Application layer attack distribution" insights are not available at an ASN level.

Authentication methods

SPF ↗︎, DKIM ↗︎, and DMARC ↗︎ are policy-driven email authentication methods and when used together, they help prevent spammers, phishers, and other unauthorized parties from sending emails on behalf of a domain they do not own. PASS is the share of processed messages that pass the associated checks. FAIL is the share of processed messages that fail the associated checks. NONE is the share of processed messages for which no associated policy could be found. Data for these metrics comes from Cloudflare’s email routing service.

Autonomous systems

The Internet is a network of networks, and autonomous systems are the networks that make up the Internet. More specifically, an autonomous system (AS) is a large network or group of networks that has a unified routing policy - the process by which a path through one or more networks is chosen.

Data packets hop from one AS to another until they reach their final destination. Every computer or device that connects to the Internet is connected to an AS. ISPs have one or more ASes, and each AS is assigned an official Autonomous System Number (ASN) for use in Border Gateway Protocol (BGP) routing. For example, Cloudflare's ASN is AS13335. Learn more in the Cloudflare Learning Center ↗︎.

Autonomous System Provider Authorization (ASPA)

Autonomous System Provider Authorization (ASPA) ↗︎ is a cryptographic object within the Resource Public Key Infrastructure (RPKI) ↗︎ that extends route security beyond origin validation. While RPKI Route Origin Authorizations (ROAs) verify which Autonomous System (AS) ↗︎ is authorized to originate a prefix, ASPA validates the BGP AS_PATH by allowing an AS to declare its authorized upstream transit providers, enabling detection of route leaks and certain BGP hijacks with forged path segments.

Each ASPA record is created by a Customer AS (CAS) and lists a Set of Provider ASes (SPAS) authorized to propagate its routes upstream. Routers use these Customer-to-Provider relationships to evaluate whether a BGP AS_PATH is consistent with the legitimate routing topology, producing a verification outcome of Valid, Invalid, or Unknown. Although the IETF specification remains in draft, support for creating ASPA objects is available in RIR portals such as ARIN ↗︎ and RIPE NCC ↗︎, and validation logic has been implemented in routing stacks including OpenBGPD ↗︎ and BIRD ↗︎.

BGP announcements

Border Gateway Protocol (BGP) is the routing protocol for the Internet. Much like the post office processing mail, BGP picks the most efficient routes for delivering Internet traffic. A BGP announcement is a way for an AS to say to another, "When you receive traffic to this network prefix, please send it to me". That message is then processed and (possibly) forwarded to other ASes, allowing for every AS in the path to learn where to send traffic to that network prefix. Learn more in the Cloudflare Learning Center ↗︎.

On Cloudflare Radar, we provide time series charts for both the volume of BGP messages announced by ASes and the total size of their announced IP address space. BGP message volume shows the level of overall routing activity for a given AS, while announced IP address space indicates the size of the networks a given AS operates over time. We represent the IP address space size with the number of minimum routable network prefix sizes, which are the number of /24 prefixes for IPv4 and /48s for IPv6. Correspondingly, a /24 prefix represents 256 IP addresses while a /48 represents 2^80 IP addresses.

BGP route leaks

BGP route leaks ↗︎ are defined as the propagation of routing announcements beyond their intended scope. In Cloudflare Radar, you can inspect the detected route leak events on the corresponding autonomous system number (ASN) pages. The columns in the table are defined as follows:

  • From: The autonomous system (AS) from which the routes are learned from.
  • By: The AS that leaked the routes, or the leaker.
  • To: The AS that received and propagated the leaked routes.
  • Start and End: The starting and ending time of a route leak event.
  • BGP Msgs.: The number of BGP announcements that contain leaked routes.
  • Prefixes: The number of IP prefixes a route leak event affects.
  • Origins: The number of origin ASes a route leak event affects.
  • Vantage Points: The number of route collectors that observed a route leak event.

Learn more about our route leak detection system design and usages in How we detect route leaks and our new Cloudflare Radar route leak service ↗︎ blog post.

BGP origin hijacks

BGP origin hijack ↗︎ is one type of BGP anomaly where networks falsely announce ownership for groups of IP addresses (prefixes) that they do not own, control, or route to. A BGP origin hijack can redirect Internet traffic to the hijacker from its legitimate destination, causing data loss with potential leak of private/confidential information.

In Cloudflare Radar, you can inspect the detected BGP origin hijack events in the "BGP Origin Hijacks" table. The columns of the table are defined as follows:

  • ID: Event ID, clickable and navigates to the event details page.
  • Detected Origin: The AS that originated the prefixes at the time of detection, potentially being a BGP hijacker.
  • Expected Origin(s): The AS(es) that are expected to originate the corresponding prefixes based on various evidences.
  • Start Time (UTC) and Duration: The detected timestamp in UTC with a human-readable time duration for how long the event lasted. Ongoing events will not have a duration value, indicated by the -- sign.
  • BGP Messages: The number of BGP messages that contain the detected anomaly.
  • Prefixes: The prefixes hijacked during the event, showing only one full prefix due to table space limitation.
  • Confidence: The level of confidence that we have on the event being a true hijacks. Values can be High, Medium, or Low.
  • Tags: The relevant evidence presented as short tags, presenting key facts we compiled using additional data sources, such as RPKI validation results or network relationship.

You can also access the detection result programmatically via our public API (CC BY-NC 4.0 ↗︎ license).

BGP real-time routes

Cloudflare Radar's prefix routing page displays real-time BGP routes as a Sankey diagram ↗︎. This visualization is built using MRT data from RouteViews ↗︎ and RIPE RIS ↗︎, combined with real-time streams from RouteViews' Kafka instance and RIS Live ↗︎.

By default, the route visualization shows paths from the originating AS to Tier-1 networks ↗︎, omitting the segments from Tier-1 networks to BGP route collectors for clarity. Users can choose to see the complete paths using the "Show full paths" toggle.

Above the visualization, a table details the prefix origin, including the originating AS, its visibility percentage across route collectors, and RPKI ↗︎ validation status (valid, invalid, unknown).

Hovering over a link in the diagram reveals a tooltip with the connected ASNs, the observing BGP route collectors (from RIPE RIS ↗︎ and RouteViews ↗︎), and the last update timestamp.

Bot vs. human traffic

The percentage of HTTP requests classified as bot versus human, based on bot scores. Requests with a bot score between 1 and 29 are classified as likely automated (bot), while requests with a score of 30 or above are classified as likely human. For more information, refer to Bot classes.

By default, Radar shows bot vs. human traffic for requests to HTML content. This filter is meant to represent traditional web traffic by excluding API calls, asset requests (images, scripts, fonts), and other machine-to-machine requests.

Certificates

Encryption is a critical part of a safe Internet. SSL/TLS is the standard security technology for establishing an encrypted link between a client and a server.

In Cloudflare Radar, you can view all certificates issued for a given domain by a trusted Certificate Authority that are listed in active certificate transparency logs.

You can review the certificates issued for your domain name to ensure that there have been no incorrect or fraudulent issuances of certificates associated with your domains. You can also sign up to receive alerts from our certificate transparency monitor in the Cloudflare Dashboard ↗︎.

Certificate Transparency

Certificate Transparency (CT) ↗︎ is an Internet security standard for monitoring and auditing the issuance of digital certificates issued by Certification Authorities (CAs). CT helps detect misissued or malicious certificates by requiring CAs to publicly log all certificates they issue in append-only, verifiable logs. These logs are monitored by various entities, including browsers and security researchers, to ensure transparency and trust in the certificate ecosystem.

Key entities in CT include:

  • CAs: Organizations that issue certificates.
  • CT Logs: Public, append-only logs where issued certificates are recorded.
  • Monitors: Parties that check logs for correctness.

The data available in Cloudflare Radar is derived from the CT logs currently monitored by Cloudflare. This enables visibility into certificate issuance trends, distributions, and metadata across the web.

Connection characteristics

Share of inbound connections to Cloudflare from mail transfer agents with the given characteristics. “IP Version” breaks down connections made over IPv4 and IPv6. “Encryption” breaks down connections made over an encrypted connection using TLS, and those made over an unencrypted connection, in the clear. Data for these metrics comes from Cloudflare’s email routing service.

Connection quality

Connection quality metrics include download and upload speed, latency (round-trip time), and latency jitter (round-trip time stability), reflecting the best expected performance for specific countries or ASNs. These metrics are derived from speed tests initiated by end users on the Cloudflare Speed Test website ↗︎, aggregated over the previous 90 days. The underlying raw data is freely accessible for analysis through Measurement Lab's BigQuery ↗︎.