A technique for monitoring activity in a content delivery network is disclosed. A method implementation of the technique is performed by a monitoring component associated with the content delivery network and comprises extracting (S302), from one or more event logs of the content delivery network, a plurality of IP addresses and a plurality of events associated with the plurality of IP addresses, obtaining (S304) geolocation information for each of the plurality of IP addresses, generating (S306), for each of the plurality of IP addresses, a geohash based on the geolocation information, grouping (S308) the plurality of IP addresses by their geohash to determine a plurality of geohash groups representative of IP addresses having a same geohash, creating (S310) a geohash index including, for each of the plurality of geohash groups, the geohash of the respective geohash group along with a number of IP addresses included in the respective geohash group and cumulative event information associated with the IP addresses of the respective geohash group, and monitoring (S312) activity in the content delivery network based on the geohash index.