Cloudflare changelogs | Radar

Radar - Routing Section Expansion on Cloudflare Radar

Wed, 01 Apr 2026 00:00:00 GMT

Radar now features an expanded Routing section with dedicated sub-pages, providing a more organized and in-depth view of the global routing ecosystem. This restructuring lays the groundwork for additional routing features and widgets coming in the near future.

Dedicated sub-pages

The single Routing page has been split into three focused sub-pages:

Overview — Routing statistics, IP address space trends, BGP announcements, and the new Top 100 ASes ranking.
RPKI — RPKI validation status, ASPA deployment trends, and per-ASN ASPA provider details.
Anomalies — BGP route leaks, origin hijacks, and Multi-Origin AS (MOAS) conflicts.

New widgets

The routing overview now includes a Top 100 ASes table ranking autonomous systems by customer cone size, IPv4 address space, or IPv6 address space. Users can switch between rankings using a segmented control.

The RPKI sub-page introduces a RPKI validation view for per-ASN pages, showing prefixes grouped by RPKI validation status (Valid, Invalid, Unknown) with visibility scores.

Improved IP address space chart

The IP address space chart now displays both IPv4 and IPv6 trends stacked vertically and is available on global, country, and AS views.

Check out the Radar routing section to explore the data, and stay tuned for more routing insights coming soon.

Radar - URL Scanner improvements on Cloudflare Radar

Thu, 26 Mar 2026 00:00:00 GMT

Radar ships several improvements to the URL Scanner that make scan reports more informative and easier to share:

Live screenshots — the summary card now includes an option to capture a live screenshot of the scanned URL on demand using the Browser Rendering API.
Save as PDF — a new button generates a print-optimized document aggregating all tab contents (Summary, Security, Network, Behavior, and Indicators) into a single file.
Download as JSON — raw scan data is available as a JSON download for programmatic use.
Redesigned summary layout — page information and security details are now displayed side by side with the screenshot, with a layout that adapts to narrower viewports.
File downloads — downloads are separated into a dedicated card with expandable rows showing each file's source URL and SHA256 hash.
Detailed IP address data — the Network tab now includes additional detail per IP address observed during the scan.

Explore these improvements on the Cloudflare Radar URL Scanner.

Radar - Region Filtering, AS Traffic Volume, and Navigation Improvements on Cloudflare Radar

Fri, 06 Mar 2026 00:00:00 GMT

Radar ships several new features that improve the flexibility and usability of the platform, as well as visibility into what is happening on the Internet.

Region filtering

All location-aware pages now support filtering by region, including continents, geographic subregions (Middle East, Eastern Asia, etc.), political regions (EU, African Union), and US Census regions/divisions (for example, New England, US Northeast).

Traffic volume by top autonomous systems and locations

A new traffic volume view shows the top autonomous systems and countries/territories for a given location. This is useful for quickly determining which network providers in a location may be experiencing connectivity issues, or how traffic is distributed across a region.

The new AS and location dimensions have also been added to the Data Explorer for the HTTP, DNS, and NetFlows datasets. Combined with other available filters, this provides a powerful tool for generating unique insights.

Finally, breadcrumb navigation is now available on most pages, allowing easier navigation between parent and related pages.

Check out these features on Cloudflare Radar.

Radar - Network Quality Test on Cloudflare Radar

Tue, 03 Mar 2026 00:00:00 GMT

Radar now includes a Network Quality Test page. The tool measures Internet connection quality and performance, showing connection details such as IP address, server location, network (ASN), and IP version. For more detailed speed test results, the page links to speed.cloudflare.com.

Radar - Post-Quantum Encryption and Key Transparency on Cloudflare Radar

Fri, 27 Feb 2026 00:00:00 GMT

Radar now tracks post-quantum encryption support on origin servers, provides a tool to test any host for post-quantum compatibility, and introduces a Key Transparency dashboard for monitoring end-to-end encrypted messaging audit logs.

Post-quantum origin support

The new Post-Quantum API provides the following endpoints:

/post_quantum/tls/support - Tests whether a host supports post-quantum TLS key exchange.
/post_quantum/origin/summary/{dimension} - Returns origin post-quantum data summarized by key agreement algorithm.
/post_quantum/origin/timeseries_groups/{dimension} - Returns origin post-quantum timeseries data grouped by key agreement algorithm.

The new Post-Quantum Encryption page shows the share of customer origins supporting X25519MLKEM768, derived from daily automated TLS scans of TLS 1.3-compatible origins. The scanner tests for algorithm support rather than the origin server's configured preference.

A host test tool allows checking any publicly accessible website for post-quantum encryption compatibility. Enter a hostname and optional port to see whether the server negotiates a post-quantum key exchange algorithm.

Key Transparency

A new Key Transparency section displays the audit status of Key Transparency logs for end-to-end encrypted messaging services. The page launches with two monitored logs: WhatsApp and Facebook Messenger Transport.

Each log card shows the current status, last signed epoch, last verified epoch, and the root hash of the Auditable Key Directory tree. The data is also available through the Key Transparency Auditor API.

Learn more about these features in our blog post and check out the Post-Quantum Encryption and Key Transparency pages to explore the data.

Radar - RPKI ASPA Deployment Insights on Cloudflare Radar

Wed, 25 Feb 2026 00:00:00 GMT

Radar now includes Autonomous System Provider Authorization (ASPA) deployment insights, providing visibility into the adoption and verification of ASPA objects across the global routing ecosystem.

New API endpoints

The new ASPA API provides the following endpoints:

/bgp/rpki/aspa/snapshot - Retrieves current or historical ASPA objects.
/bgp/rpki/aspa/changes - Retrieves changes to ASPA objects over time.
/bgp/rpki/aspa/timeseries - Retrieves ASPA object counts over time as a timeseries.

New Radar widgets

The global routing page now shows the ASPA deployment trend over time by counting daily ASPA objects.

The global routing page also displays the most recent ASPA objects, searchable by ASN or AS name.

On country and region routing pages, a new widget shows the ASPA deployment rate for ASNs registered in the selected country or region.

On AS routing pages, the connectivity table now includes checkmarks for ASPA-verified upstreams. All ASPA upstreams are listed in a dedicated table, and a timeline shows ASPA changes at daily granularity.

Check out the Radar routing page to explore the data.

Radar - Content Type Dimension for AI Bots in Cloudflare Radar

Thu, 12 Feb 2026 00:00:00 GMT

Radar now includes content type insights for AI bot and crawler traffic. The new content_type dimension and filter shows the distribution of content types returned to AI crawlers, grouped by MIME type category.

The content type dimension and filter are available via the following API endpoints:

Content type categories:

HTML - Web pages (text/html)
Images - All image formats (image/*)
JSON - JSON data and API responses (application/json, *+json)
JavaScript - Scripts (application/javascript, text/javascript)
CSS - Stylesheets (text/css)
Plain Text - Unformatted text (text/plain)
Fonts - Web fonts (font/*, application/font-*)
XML - XML documents and feeds (text/xml, application/xml, application/rss+xml, application/atom+xml)
YAML - Configuration files (text/yaml, application/yaml)
Video - Video content and streaming (video/*, application/ogg, *mpegurl)
Audio - Audio content (audio/*)
Markdown - Markdown documents (text/markdown)
Documents - PDFs, Office documents, ePub, CSV (application/pdf, application/msword, text/csv)
Binary - Executables, archives, WebAssembly (application/octet-stream, application/zip, application/wasm)
Serialization - Binary API formats (application/protobuf, application/grpc, application/msgpack)
Other - All other content types

Additionally, individual bot information pages now display content type distribution for AI crawlers that exist in both the Verified Bots and AI Bots datasets.

Check out the AI Insights page to explore the data.

Radar - Cloud Services Observability in Cloudflare Radar

Mon, 24 Nov 2025 00:00:00 GMT

Radar introduces HTTP Origins insights, providing visibility into the status of traffic between Cloudflare's global network and cloud-based origin infrastructure.

The new Origins API provides provides the following endpoints:

/origins - Lists all origins (cloud providers and associated regions).
/origins/{origin} - Retrieves information about a specific origin (cloud provider).
/origins/timeseries - Retrieves normalized time series data for a specific origin, including the following metrics:
- REQUESTS: Number of requests
- CONNECTION_FAILURES: Number of connection failures
- RESPONSE_HEADER_RECEIVE_DURATION: Duration of the response header receive
- TCP_HANDSHAKE_DURATION: Duration of the TCP handshake
- TCP_RTT: TCP round trip time
- TLS_HANDSHAKE_DURATION: Duration of the TLS handshake
/origins/summary - Retrieves HTTP requests to origins summarized by a dimension.
/origins/timeseries_groups - Retrieves timeseries data for HTTP requests to origins grouped by a dimension.

The following dimensions are available for the summary and timeseries_groups endpoints:

region: Origin region
success_rate: Success rate of requests (2XX versus 5XX response codes)
percentile: Percentiles of metrics listed above

Additionally, the Annotations and Traffic Anomalies APIs have been extended to support origin outages and anomalies, enabling automated detection and alerting for origin infrastructure issues.

Check out the new Radar page.

Radar - TLD Insights in Cloudflare Radar

Mon, 27 Oct 2025 00:00:00 GMT

Radar now introduces Top-Level Domain (TLD) insights, providing visibility into popularity based on the DNS magnitude metric, detailed TLD information including its type, manager, DNSSEC support, RDAP support, and WHOIS data, and trends such as DNS query volume and geographic distribution observed by the 1.1.1.1 DNS resolver.

The following dimensions were added to the Radar DNS API, specifically, to the /dns/summary/{dimension} and /dns/timeseries_groups/{dimension} endpoints:

tld: Top-level domain extracted from DNS queries; can also be used as a filter.
tld_dns_magnitude: Top-level domain ranking by DNS magnitude.

And the following endpoints were added:

/tlds - Lists all TLDs.
/tlds/{tld} - Retrieves information about a specific TLD.

Learn more about the new Radar DNS insights in our blog post, and check out the new Radar page.

Radar - Expanded CT log activity insights on Cloudflare Radar

Thu, 09 Oct 2025 00:00:00 GMT

Radar has expanded its Certificate Transparency (CT) log insights with new stats that provide greater visibility into log activity:

Log growth rate: The average throughput of the CT log over the past 7 days, measured in certificates per hour.
Included certificate count: The total number of certificates already included in this CT log.
Eligible-for-inclusion certificate count: The number of certificates eligible for inclusion in this log but not yet included. This metric is based on certificates signed by trusted root CAs within the log’s accepted date range.
Last update: The timestamp of the most recent update to the CT log.

These new statistics have been added to the response of the Get Certificate Log Details API endpoint, and are displayed on the CT log information page.

Radar - Browser Support Detection for PQ Encryption on Cloudflare Radar

Mon, 06 Oct 2025 00:00:00 GMT

Radar now includes browser detection for Post-quantum (PQ) encryption. The Post-quantum encryption card now checks whether a user’s browser supports post-quantum encryption. If support is detected, information about the key agreement in use is displayed.

Radar - Regional Data in Cloudflare Radar

Mon, 29 Sep 2025 00:00:00 GMT

Radar now introduces Regional Data, providing traffic insights that bring a more localized perspective to the traffic trends shown on Radar.

The following API endpoints are now available:

Get Geolocation - Retrieves geolocation by geoId.
List Geolocations - Lists geolocations.
NetFlows Summary By Dimension - Retrieves NetFlows summary by dimension.

All summary and timeseries_groups endpoints in HTTP and NetFlows now include an adm1 dimension for grouping data by first level administrative division (for example, state, province, etc.)

A new filter geoId was also added to all endpoints in HTTP and NetFlows, allowing filtering by a specific administrative division.

Check out the new Regional traffic insights on a country specific traffic page new Radar page.

Radar - Certificate Transparency Insights in Cloudflare Radar

Wed, 06 Aug 2025 00:00:00 GMT

Radar now introduces Certificate Transparency (CT) insights, providing visibility into certificate issuance trends based on Certificate Transparency logs currently monitored by Cloudflare.

The following API endpoints are now available:

/ct/timeseries: Retrieves certificate issuance time series.
/ct/summary/{dimension}: Retrieves certificate distribution by dimension.
/ct/timeseries_groups/{dimension}: Retrieves time series of certificate distribution by dimension.
/ct/authorities: Lists certification authorities.
/ct/authorities/{ca_slug}: Retrieves details about a Certification Authority (CA). CA information is derived from the Common CA Database (CCADB).
/ct/logs: Lists CT logs.
/ct/logs/{log_slug}: Retrieves details about a CT log. CT log information is derived from the Google Chrome log list.

For the summary and timeseries_groups endpoints, the following dimensions are available (and also usable as filters):

ca: Certification Authority (certificate issuer)
ca_owner: Certification Authority Owner
duration: Certificate validity duration (between NotBefore and NotAfter dates)
entry_type: Entry type (certificate vs. pre-certificate)
expiration_status: Expiration status (valid vs. expired)
has_ips: Presence of IP addresses in certificate Subject Alternative Names (SANs)
has_wildcards: Presence of wildcard DNS names in certificate SANs
log: CT log name
log_api: CT log API (RFC6962 vs. Static)
log_operator: CT log operator
public_key_algorithm: Public key algorithm of certificate's key
signature_algorithm: Signature algorithm used by CA to sign certificate
tld: Top-level domain for DNS names found in certificates SANs
validation_level: Validation level

Check out the new Certificate Transparency insights in the new Radar page.

Radar - Bot & Crawler Insights in Cloudflare Radar

Tue, 01 Jul 2025 00:00:00 GMT

Web crawlers insights

Radar now offers expanded insights into web crawlers, giving you greater visibility into aggregated trends in crawl and refer activity.

We have introduced the following endpoints:

/bots/crawlers/summary/{dimension}: Returns an overview of crawler HTTP request distributions across key dimensions.
/bots/crawlers/timeseries_groups/{dimension}: Provides time-series data on crawler request distributions across the same dimensions.

These endpoints allow analysis across the following dimensions:

user_agent: Parsed data from the User-Agent header.
referer: Parsed data from the Referer header.
crawl_refer_ratio: Ratio of HTML page crawl requests to HTML page referrals by platform.

Broader bot insights

In addition to crawler-specific insights, Radar now provides a broader set of bot endpoints:

/bots/: Lists all bots.
/bots/{bot_slug}: Returns detailed metadata for a specific bot.
/bots/timeseries: Time-series data for bot activity.
/bots/summary/{dimension}: Returns an overview of bot HTTP request distributions across key dimensions.
/bots/timeseries_groups/{dimension}: Provides time-series data on bot request distributions across the same dimensions.

These endpoints support filtering and breakdowns by:

bot: Bot name.
bot_operator: The organization or entity operating the bot.
bot_category: Classification of bot type.

The previously available verified_bots endpoints have now been deprecated in favor of this set of bot insights APIs. While current data still focuses on verified bots, we plan to expand support for unverified bot traffic in the future.

Learn more about the new Radar bot and crawler insights in our blog post.

Radar - Leaked Credentials Insights in Cloudflare Radar

Tue, 18 Mar 2025 00:00:00 GMT

Radar has expanded its security insights, providing visibility into aggregate trends in authentication requests, including the detection of leaked credentials through leaked credentials detection scans.

We have now introduced the following endpoints:

/leaked_credential_checks/summary/{dimension}: Retrieves summaries of HTTP authentication requests distribution across two different dimensions.
/leaked_credential_checks/timeseries_groups/{dimension}: Retrieves timeseries data for HTTP authentication requests distribution across two different dimensions.

The following dimensions are available, displaying the distribution of HTTP authentication requests based on:

compromised: Credential status (clean vs. compromised).
bot_class: Bot class (human vs. bot).

Dive deeper into leaked credential detection in this blog post and learn more about the expanded Radar security insights in our blog post.

Radar - DNS Insights in Cloudflare Radar

Thu, 27 Feb 2025 00:00:00 GMT

Radar has expanded its DNS insights, providing visibility into aggregated traffic and usage trends observed by our 1.1.1.1 DNS resolver. In addition to global, location, and ASN traffic trends, we are also providing perspectives on protocol usage, query/response characteristics, and DNSSEC usage.

Previously limited to the top locations and ASes endpoints, we have now introduced the following endpoints:

/dns/timeseries: Retrieves DNS query volume over time.
/dns/summary/{dimension}: Retrieves summaries of DNS query distribution across ten different dimensions.
/dns/timeseries_groups/{dimension}: Retrieves timeseries data for DNS query distribution across ten different dimensions.

For the summary and timeseries_groups endpoints, the following dimensions are available, displaying the distribution of DNS queries based on:

cache_hit: Cache status (hit vs. miss).
dnsssec: DNSSEC support status (secure, insecure, invalid or other).
dnsssec_aware: DNSSEC client awareness (aware vs. not-aware).
dnsssec_e2e: End-to-end security (secure vs. insecure).
ip_version: IP version (IPv4 vs. IPv6).
matching_answer: Matching answer status (match vs. no-match).
protocol: Transport protocol (UDP, TLS, HTTPS or TCP).
query_type: Query type (A, AAAA, PTR, etc.).
response_code: Response code (NOERROR, NXDOMAIN, REFUSED, etc.).
response_ttl: Response TTL.

Learn more about the new Radar DNS insights in our blog post, and check out the new Radar page.

Radar - Expanded AI insights in Cloudflare Radar

Tue, 04 Feb 2025 00:00:00 GMT

Radar has expanded its AI insights with new API endpoints for Internet services rankings, robots.txt analysis, and AI inference data.

Internet services ranking

Radar now provides rankings for Internet services, including Generative AI platforms, based on anonymized 1.1.1.1 resolver data. Previously limited to the annual Year in Review, these insights are now available daily via the API, through the following endpoints:

/ranking/internet_services/top show service popularity at a specific date.
/ranking/internet_services/timeseries_groups track ranking trends over time.

Robots.txt

Radar now analyzes robots.txt files from the top 10,000 domains, identifying AI bot access rules. AI-focused user agents from ai.robots.txt are categorized as:

Fully allowed/disallowed if directives apply to all paths (*).
Partially allowed/disallowed if restrictions apply to specific paths.

These insights are now available weekly via the API, through the following endpoints:

/robots_txt/top/user_agents/directive to get the top AI user agents by directive.
/robots_txt/top/domain_categories to get the top domain categories by robots.txt files.

Workers AI

Radar now provides insights into public AI inference models from Workers AI, tracking usage trends across models and tasks. These insights are now available via the API, through the following endpoints:

/ai/inference/summary/{dimension} to view aggregated model and task popularity.
/ai/inference/timeseries_groups/{dimension} to track changes over time for model or task.

Learn more about the new Radar AI insights in our blog post.