No IP addresses are collected. We don't have a concept of a "user" to hang any data on. The data we do collect are these:For all queries
We add to a tally of the query type, whether it was IPv4 or IPv6, for an A record or an AAAA record, etc., but not what the query was for nor where it was from. So, that's protocol type, but not payload.
We also implicitly know which of our servers we're tallying on, and we only aggregate those to the city level. So, for instance, we know if a DDoS that's composed primarily of IPv4 A queries is hitting Frankfurt more than Munich.
For the subset of queries which want malware blocking
For the subset of those which match one of the malware-blocked domains
We also add to a tally of how many times that blocked domain has been matched. Unlike the more general protocol-type data above, this tally is counted globally, not retained on a per-city level.