Summary

Cloudflare Radar used data from Cloudflare's 330+ points of presence to analyze how the June–July 2026 World Cup changed global online behavior. The analysis compared per-country, per-minute traffic to a "normal" baseline defined as the median traffic from the four preceding weeks, and reported changes as a log2 ratio (log2(current / baseline)): 0 = normal, +1 = twice normal, −1 = half normal. Matches that kicked off locally between midnight and 8am produced the largest deviations (sometimes >2×), while matches during normal daytime/work hours had minimal impact.

Key Points

• Baseline definition: median traffic over the four prior weeks (per-country, per-minute) to smooth noise and enable fair comparisons.
• Measurement metric: log2(current / baseline) — symmetric for increases/decreases and easy to interpret (+1 = 2×, −1 = 0.5×).
• Temporal effect: largest spikes occurred when matches fell in local overnight / early-morning windows (~00:00–08:00 local time).
• Daytime matches (≈09:00–mid-afternoon local) showed little aggregate traffic change compared to baseline.
• Data sources: HTTP, DNS, and security telemetry from Cloudflare's global network.

Operational recommendations

• Use per-region/time-of-day baselines when setting autoscaling and alert thresholds to avoid false positives during major global events.
• Prefer ratio-based or log-scaled anomaly detection (like log2 ratio) to compare across populations with different absolute volumes.
• Prepare capacity and cache strategies for overnight/early-morning surge scenarios (priming caches, pre-warming connections, peering checks).
• Run load tests that simulate local-time surges rather than only daytime traffic patterns, and validate monitoring dashboards against multi-week medians.