Cloudflare reports almost 7% of internet traffic is malicious

30% is plain ridiculous. Cloudflare is believed to counts as bots even the real users who fail their verification, including:

- people with older browsers who fail it automatically due to unsupported features

- whoever gets stuck in captcha loops and gives up eventually

- whoever has a slow internet connection and gives up during the verification process

This happens to be a lot of people, especially the less technical ones with less access to good technology, which is why we rarely hear complaints on HN.

This way, the Cloudflare people can tell you some completely made up numbers, like "This month we blocked one gazillion malicious bots and saved you 30 yottabytes of data", which makes it look like they're doing something of value instead of making the internet a more closed, restricted, corporate and centralized place.

I would go with the lower 7% estimate today. The last major traffic sink in Internet history was ASCII email-spam, Internet oldsters of every gender pummeled with penis enhancement devices and 411 traffic. It was discussed a lot on the NANOG mailing list 1995-2005 and major portions of IPv4 space were NOT partitioned very well between customer ISP space and their server farms... so from international sources you could expect valid email to come from any address.

The other 'spam' of the time was ICMP traffic. Nets were so flaky in those days everyone who could write a script was running pings to what remote servers they had. Many were idiots that didn't even realize you can send small pings with no padded payloads. And of course there were ICMP reflection attacks from bad actors with incredible payloads and address spoofing. So one number I remember is that combined spam-email and ICMP demanded 50% of bandwidth at times. But remember, at the time the principal use of the net was to move ASCII and ASCII-compressed content.

While the botspam of today probably exceeds any historical levels, the percentage is low because bots do not watch or serve video. The botspam is spoofing humans on websites and port probing for automated exploit.

I would personally consider ad tracking networks malicious too so i think that's pretty low yeah :)

Now apply that number to MAUs for various applications.

This talking point is tired. They would just pay $100/month for ddos-guard. I don't understand why Cloudflare should be forced to screen customers by default or held to a standard that no other Internet business is. Why not go up the chain and start protesting outside Verisign HQ?

Crime exists, says company that sells burglar alarms.