What 2025 Attack Traffic Means for Developers and Security Teams

Security reports often lead with large numbers.

Billions of malicious requests. Terabit-scale DDoS attacks. Millions of automated bot requests every day.

The numbers matter, but the more useful question for developers is this:

What do these traffic patterns reveal about how applications are being attacked?

Based on traffic observed and mitigated by CDNetworks during 2025, one pattern stands out. Many attacks are designed to resemble legitimate activity.

They use standard protocols, expected application paths, authenticated sessions, and technically valid API requests. Detecting them requires more than matching signatures or blocking unusual IP addresses.

Here are four signals engineering and security teams should pay attention to.

1. DDoS Protection Must Cover More Than Bandwidth

CDNetworks blocked more than 227 million network-layer DDoS attack requests in 2025.

Among them:

• 329 attacks exceeded 1 Tbps
• The largest attack reached 1.55 Tbps
• Software and IT Services was the most targeted sector for network-layer DDoS attacks

Terabit-scale attacks are becoming a repeatable operational scenario.

However, network capacity represents only part of the problem.

Application-layer DDoS attacks can target expensive operations such as:

• Login and authentication
• Search
• Checkout
• Dynamic content generation
• API requests
• Database-intensive queries

A relatively small HTTP request can trigger several backend operations. Enough requests to a resource-intensive endpoint may degrade an application without saturating the network.

For engineering teams, DDoS testing should therefore examine application dependencies, worker pools, database capacity, caching behavior, and third-party services, alongside bandwidth.

2. Web Attacks Require End-to-End Request Visibility

CDNetworks blocked more than 21.51 billion web application attack requests during 2025.

Almost 60% occurred during the second half of the year, while HTTP protocol anomalies accounted for 45% of the total.

Modern application requests often travel through several components:

Client
  ↓
CDN or security edge
  ↓
Load balancer
  ↓
Reverse proxy or API gateway
  ↓
Application server
  ↓
Database and internal services

Each component may interpret malformed headers, encodings, request lengths, or protocol behavior differently.

This creates opportunities for attackers to test inconsistencies between systems.

Edge logs alone may not provide enough context. Teams should be able to connect a suspicious request with:

• The targeted endpoint
• Authentication status
• Session history
• Application response
• Upstream latency
• Backend errors
• Related requests from the same identity or device

Consistent request IDs across the delivery path make this investigation significantly easier.

3. Bot Management Is a Policy Problem

In 2025, 74% of classified bot traffic came from bad bots.

CDNetworks also observed an average of 1.64 million AI bot requests per day, with data scrapers accounting for more than 72% of recorded AI bot activity.

The technical challenge is that automated traffic can serve very different purposes.

A bot may be:

• A search crawler
• A monitoring service
• An AI agent
• A commercial scraper
• A credential-stuffing tool
• An inventory-hoarding bot
• An account-abuse system

Blocking all automation would disrupt legitimate services. Allowing all automation would expose applications, data, accounts, and infrastructure resources.

Bot policies should therefore reflect the purpose of each endpoint.

For example:

routes:
  /public-docs:
    verified-crawlers: allow
    unknown-bots: rate-limit

  /account:
    crawlers: block
    suspicious-automation: challenge

  /api/inventory:
    authentication: required
    behavioral-monitoring: enabled

The exact syntax depends on the security platform, but the underlying principle remains the same. Public content, account systems, APIs, and transactional workflows should not share one universal bot policy.

4. API Abuse Can Look Technically Valid

CDNetworks blocked an average of more than 15 billion malicious API requests per month during 2025.

API attacks can be difficult to identify because individual requests may appear legitimate.

A malicious request may:

• Use valid JSON
• Match the expected schema
• Include a valid token
• Target a documented endpoint
• Stay below an IP rate limit
• Receive a successful response

The risk appears when the request is connected to behavior over time.

Consider an authenticated user querying an inventory API. One request may be expected. Thousands of queries distributed across several accounts, devices, and IP addresses may indicate scraping or automated purchasing activity.

Traditional IP-based rate limiting may miss this pattern.

Sensitive APIs should also evaluate:

account_id
api_key
session_id
device_id
organization_id
endpoint
resource_id
action_frequency
historical_behavior

Security controls need to measure both request volume and business impact.

Examples include the number of accounts created, coupons redeemed, items reserved, records accessed, or payment methods tested.

The Shared Engineering Challenge

DDoS attacks, web attacks, bots, and API abuse affect different parts of the technology stack, but they reveal the same challenge:

Attack traffic often uses legitimate-looking behavior.

This makes context essential.

Security teams need infrastructure data, while developers understand application workflows. Platform teams understand dependencies, while identity teams understand users, sessions, and permissions.

These signals become more valuable when they are connected.

What Teams Should Review

Based on the 2025 traffic patterns, engineering and security teams should review five areas:

1. Expensive endpoints
   Identify requests that consume substantial compute, database, or third-party resources.

2. Cross-layer observability
   Connect edge, application, API, identity, and backend telemetry.

3. Identity-aware limits
   Apply controls across accounts, tokens, sessions, devices, and organizations, rather than relying solely on IP addresses.

4. Endpoint-specific bot policies
   Define which automated agents can access each application workflow.

5. Long-term behavioral analysis
   Look for attack activity developing over days or weeks, as well as sudden traffic spikes.

Final Thought

Blocking malicious requests remains necessary, but request-level inspection alone cannot explain every attack.

Developers and security teams also need to understand who is performing an action, how the behavior changes over time, which resources are affected, and whether the outcome aligns with expected business use.

That context is becoming a core part of application resilience.

The figures in this article are drawn from the 2025 CDNetworks State of Web Application and API Protection Report and reflect traffic observed and mitigated by the CDNetworks security platform during 2025.