Glossary (12)·续2

Network-level DDoS attacks graphs are based on traffic measured in bytes.

Post-quantum encryption adoption

The Post-Quantum Encryption Adoption graph shows the share of HTTPS requests to Cloudflare that are encrypted with post-quantum (PQ) cryptography. Additional details about Cloudflare's support for PQ cryptography can be found at Cloudflare Research ↗︎.

Post-quantum origin support

The post-quantum origin support dataset provides insights into the TLS key exchange algorithms supported by scanned customer origin servers. Additional details about post-quantum cryptography between Cloudflare and origin servers can be found in the PQC to your origin documentation.

Robots.txt

A robots.txt ↗︎ file contains instructions for bots that tell them which webpages they can and cannot access.

The data displayed for robots.txt is based on successfully parsed robots.txt files from the top 10,000 domains. From these files, we count the occurrences of each user agent under the Allow and Disallow directives. A user agent is classified as "fully allowed" or "fully disallowed" if the directive value is *. Otherwise, if the user agent is only allowed or disallowed to crawl specific paths, it is classified as "partially allowed" or "partially disallowed."

Currently, we only include AI-focused user agents listed in the ai.robots.txt ↗︎ repository.

TCP resets and timeouts

In the Transmission Control Protocol (TCP), client-initiated connection resets (via the RST flag, TCP's "panic button") are atypical, and indicate to the server that something went wrong requiring the connection to be closed immediately. Similarly, connection timeouts (where the server closes a connection due to an unresponsive client) should not happen in conventional data exchanges. For comparison, a typical TCP connection consists of a 3-way handshake initiated by a client with a SYN packet to the server, then a data exchange moderated with ACK and PSH flags in the data packets, and finally a graceful close initiated from either side with a FIN packet. A FIN close is considered graceful because it ensures both sides complete their data transfer before closing the connection. In contrast, a timeout or RST flag triggers a hard stop, even if data is waiting to be sent or acknowledged. See RFC 9293 ↗︎ for more details on the TCP protocol.

A TCP server may see timed-out or reset connections for a variety of reasons. Some are benign, such as client applications that lose connectivity or abruptly shut down (e.g., browsers cleaning up closed tabs or port scanners). Others are more concerning, such as DoS attacks ↗︎ or third-party interference. In some cases, a close examination of the packets in a connection can help to shed light on the reason for termination. For example, Global, Passive Detection of Connection Tampering ↗︎ finds that certain packet patterns can be linked to middlebox connection tampering.

On Cloudflare Radar’s Security & Attacks page ↗︎, you can view statistics on resets and timeouts from a sample of TCP connections to Cloudflare’s servers, broken down by how far the connection progressed before termination. The plot lines are defined as follows:

• Post-SYN (mid-handshake): Connection resets or timeouts after the server received only a single SYN packet.
• Post-ACK (immediately post-handshake): Connection resets or timeouts after the server received both a SYN packet and an ACK packet, meaning the connection was successfully established.
• Post-PSH (after first data packet): Connection resets or timeouts after the server received a packet with PSH flag set, following connection establishment. The PSH flag indicates that the TCP packet contains data (such as a TLS Client Hello message) ready to deliver to the application.
• Later (after multiple data packets): Connection resets within the first 10 packets from the client, but after the server has received multiple data packets.
• None: All other connections.

Learn more about the TCP resets and timeouts dataset in our blog post ↗︎.

TLD nameserver performance

TLD nameserver performance measures the response time (latency) of authoritative nameservers for top-level domains, as observed from Cloudflare's 1.1.1.1 resolver infrastructure. When the resolver forwards a DNS query upstream to a TLD's nameserver, the round-trip time is captured from the issuing Cloudflare data center. For anycasted authoritative nameservers, upstream queries are generally handled by a topologically close data center, resulting in lower median latencies compared to nameservers not deployed using anycast. This data reveals which nameservers are fastest, how latency varies across Cloudflare's global network, and how TLD infrastructure performance trends over time.

Threat categories

Attackers use multiple types of techniques when carrying out email-based attacks, including links or attachments leading to malware; identity deception, where the message appears to be coming from a trusted contact; and brand impersonation, where the message appears to be coming from a trusted brand. Categories are assigned to the various types of threats found during the analysis of a malicious email message, and a single message can have multiple categories. These categories are aggregated into “Link”, “Attachment”, “Impersonation”, and “Other” groupings. “Link” groups individual threat types where the attacker is trying to get the user to click on something, “Attachment” groups individual threat types where the attacker has attached a file to the email message, and “Impersonation” groups individual threat types where the attacker is impersonating a trusted brand or contact. The “Other” grouping includes other threat types not covered by the previous three. The percentages represent the share of malicious email messages where the given threat categories have been found. Data for this metric comes from Cloudflare’s cloud email security service.

Threat classification

Malicious email messages may be part of a phishing campaign, where recipients are tricked into sharing personal information like login details, or they are an attempt to spread malware through embedded images, links, or attachments. The percentage shown represents the share of processed messages that are classified as malicious. Data for this metric comes from Cloudflare’s cloud email security service.

Traffic type filter

• Human Only Traffic: Traffic that our algorithms determine as being generated by human activity.
• Automated Only Traffic: Traffic that our algorithms determine as being generated by bot or automated script activity.
• All Traffic: Use all traffic, which includes both human activity and automated activity.

Trends

Based on the aggregated HTTP/s metadata we see, we are able to show trends about a diverse set of metrics, including the distribution of mobile device vs. desktop traffic, the percentage of traffic detected as coming from bots, and the distribution of user agents/browsers. We also provide insights into the usage of HTTPS and IPv6.

Verified bots

Bot traffic describes any non-human traffic to a website or an app. Some bots are useful, such as search engine bots that index content for search or customer service bots that help users. Other bots may be used to perform malicious activities, such as break into user accounts or scan the web for contact information to send spam.

Verified bots, such as the ones from search engines, are usually transparent about who they are. Cloudflare manually approves well-behaved services that benefit the broader Internet and honor robots.txt.

Each entry on the Verified Bots list exists because a corresponding IP address was seen associated with a verified bot in the last 30 days. A verified bot is not necessarily good or bad.

Visitor location

The data displayed on domain-specific geographic traffic patterns is based solely on data from our recursive DNS services. All data displayed is in accordance with our privacy policies and commitments. This data may include attack traffic and cross-origin requests.

Web crawlers

Web crawlers ↗︎ are a type of bot that browses the Internet to collect and index website content. They are used by search engines like Google or Bing to make pages discoverable in search results.

They are also used by AI platforms, either to gather content for training large language models, or to retrieve up-to-date information for AI assistants. In both search and AI cases, crawlers work by following links from one page to another, creating a map of online content.

Radar's crawl-to-refer ratio metric is calculated by first mapping crawl requests for HTML pages based on the User-Agent header, and referral requests for HTML pages based on the Referer header, by platform (e.g., the ratio for Google is based on crawl requests from Googlebot, and referral requests from Google platforms). As with other traffic metrics on Radar, the aggregation resolution for the ratio data is based on the length of the selected timeframe. Additionally, note that traffic referred by native apps may not include a Referer header. As such, because the referral counts only include traffic from Web-based tools, these calculations may overstate the respective ratios, but it is unclear by how much.

WHOIS

WHOIS is a standard for publishing the contact and nameserver information for all registered domains. Each registrar maintains their own WHOIS service. Anyone can query the registrar's WHOIS service to reveal the data behind a given domain.

Workers AI

Workers AI allows you to run machine learning models, on the Cloudflare network, from your own code -- whether that be from Workers, Pages, or anywhere via the Cloudflare API. The data displayed for Workers AI is based on the number of inferences run on a model during a specific time interval.

Was this helpful?

YesNo

On this page

Docs

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/radar/glossary/#page","headline":"Glossary","description":"Definitions of key terms and concepts used across Cloudflare Radar, including traffic types, attack categories, and ranking methodologies.","url":"https://developers.cloudflare.com/radar/glossary/","inLanguage":"en","image":"https://developers.cloudflare.com/radar/glossary/og.png?v=f67a1b010f1c5d28","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

title: Radar

Skip to content

API Reference

Copy Markdown

Open in ClaudeOpen in ChatGPTOpen in Cursor

Copy MarkdownView as Markdown