Cloudflare: 6.5% of global traffic, 4.3% of emails potentially malicious

In 2024, Cloudflare’s systems mitigated 6.5% of global internet traffic as being potentially malicious. The security firm also estimates that 4.3% of emails are malicious and most often include deceptive links and identity deception.

According to the Cloudflare Radar 2024 Year in Review, Albania had the highest share of potentially malicious traffic that has been mitigated, at 42.8%.

The share of mitigated traffic in the US grew to 5%, up from 3.65% in 2023. Forty-four countries and regions had over 10% of traffic mitigated.

Cloudflare mitigates this attack traffic using DDoS mitigation techniques or Web Application Firewall (WAF) Managed Rules.

The most attacked industry was gambling/games, followed by finance.

Log4j, the critical remote code execution vulnerability in the Apache Log4j software library discovered in December 2021, still remains an active threat and a top target for attacks.

“Log4j attack activity appeared to trend generally upwards across the year, with several significant spikes visible during the first half of the year,” Cloudflare warns.

“Log4j ranges from approximately 4x to over 20x the activity seen for Atlassian Confluence Code Injection, and as much as 100x the aggregated activity seen for Authentication Bypass or Remote Code Injection vulnerabilities.”

The firm also observed significant spikes of malicious emails in late March, early April, and mid-May, when more than 14% of all emails were determined to be malicious.

“We believe that these spikes were related to targeted ‘backscatter’ attacks, where the attacker flooded a target with undeliverable messages, which then bounced the messages to the victim, whose email had been set as the reply-to: address,” the report explains.

Overall, in 2024, an average of 4.3% of emails were determined to be malicious, including those that would cause harm, such as the theft of credentials, data, or money.

Almost 43% of malicious emails contained a deceptive link, while 35% contained attempted identity deception, 25% contained credential harvesters, 23% contained brand impersonation, and 20% included extortion.

Most (99%) of the email messages that come from the .bar, .rest, and .uno top-level domains are found to be either spam or malicious. For country top-level domains, Western Samoa came out on top, with over 90% of emails sent from .ws domains categorized as malicious.

Clouflare’s Radar observed 225 major internet outages in 2024. The most common causes were government-directed shutdowns (116) and cable cuts (41). Cyberattacks caused four major internet outages.

Quantum computers could crack 87% of internet traffic

Post-quantum encryption adoption is increasing, with 13% of the encrypted (TLS 1.3) traffic already using post-quantum encryption. This is significantly higher compared to the beginning of the year when around 2% of encrypted traffic used post-quantum cryptography.

“The term “post-quantum” refers to a new set of cryptographic techniques designed to protect data from adversaries that have the ability to capture and store current data for decryption by sufficiently powerful quantum computers in the future,” Cloudflare explains.

The firm enabled post-quantum key agreement on its network by default in October 2022, but its use requires browser and client support. Google's Chrome 124 enabled post-quantum encryption by default on April 17th, 2024.

Cloudflare expects the adoption of secure encryption to continue growing in 2025, fueled by support in other Chromium-based browsers, growing default support in Mozilla Firefox, and initial testing in Apple Safari.