Distributed denial-of-service (DDoS) attacks are reaching volumes that only a few years ago appeared in exceptional incidents. Cloudflare reports having mitigated 935 network layer attacks exceeding 1 Tbps during the first half of 2026, with 805 of them concentrated between April and June. This jump represents a quarterly growth of 519% and confirms that hyper-volume attacks are becoming a regular part of the landscape for major Internet infrastructure providers.
The key factors driving DDoS growth in 20 seconds
- Cloudflare mitigated 23.2 million network layer DDoS attacks from January to June.
- Attacks over 1 Tbps increased from 130 in Q1 to 805 in Q2.
- DNS accounted for 34.3% of network attacks.
- CLDAP grew by 580% quarter-over-quarter as a reflection and amplification technique.
- 90.6% of attacks ended in less than ten minutes.
These data are part of the first-half 2026 report prepared by Cloudforce One, Cloudflare’s threat intelligence division. As with any report based on telemetry from a provider, the figures reflect what was observed within its infrastructure and do not represent a comprehensive census of all attacks on the Internet.
Nonetheless, the scale of the analyzed network reveals a clear trend. Cloudflare logged approximately 5,343 network layer attacks per hour, roughly 128,000 daily. Additionally, there were 29.64 trillion HTTP requests associated with DDoS attacks.
A 1 Tbps attack is no longer considered an anomaly
Cloudflare uses the term hyper-volume attacks for those surpassing at least one of these thresholds: 1 Tbps of bandwidth, 1 billion packets per second, or one million requests per second.
The second quarter shows how much this category is expanding.
Of the 935 attacks over 1 Tbps detected in the semester, 805 occurred between April and June. The first quarter recorded 130. The jump from 130 to 805 represents the 519% quarterly increase reported by the company.
This figure is especially relevant for hosting providers, data center operators, ISPs, and cloud platforms. An infrastructure may have sufficient aggregate bandwidth and still have intermediate components incapable of processing certain packet rates.
This explains why measuring a DDoS solely in Gbps or Tbps can be misleading.
An attack might aim to fully saturate Internet links but also flood connection tables, firewalls, routers, or load balancers with enormous numbers of small packets. At the application layer, the goal could be to exhaust servers via HTTP requests that individually seem legitimate.
Moreover, volume and duration are not always directly linked.
90% end before an administrator can react
One of the most useful insights from the report for IT teams is precisely about attack duration.
90.6% of observed attacks concluded in less than ten minutes. At the same time, 96.62% of network layer attacks remained below 500 Mbps.
The apparent contradiction of ever-increasing attack sizes versus the majority being short-lived incidents disappears when considering the distribution: there are millions of relatively modest attacks, alongside a rapidly growing category of extreme attacks.
Cloudflare has recorded hyper-volume attacks lasting just 35 seconds.
This shifts the approach to protection design.
A model based on detecting anomalies, raising alerts, and waiting for manual rule application can be too slow. By the time an operator intervenes, the traffic spike may have already subsided.
Automatic and persistent mitigation efforts are gaining importance over on-demand protection models. Not because all attacks require hundreds of terabits of capacity, but because the window to decide which traffic to block can be measured in seconds.
The effects of an attack also may linger after it ends. Connections may be exhausted, TCP retransmissions, timeouts, routing issues, or dependent services might be struggling to recover simultaneously.
DNS returning to the center of network attacks
Another significant change concerns the techniques used.
In the first half of 2026, attacks related to DNS accounted for 34.3% of network layer DDoS. DNS Floods alone shifted from 25.7% to 40% between Q1 and Q2.
Although both forms rely on DNS infrastructure, a DNS Flood and amplification attack operate differently.
In the case of DNS Floods, attackers send large amounts of queries directly to the victim’s DNS servers. If saturated, users cannot resolve domains and related services.
DNS amplification leverages third-party DNS servers.
The attacker spoofs the source IP address so a small request appears to come from the victim. The DNS server responds to that address with a significantly larger amount of information than the original query.
The result is a way to multiply traffic without the attacker generating it all directly.
This approach is particularly effective with UDP because this protocol does not establish a connection beforehand, unlike TCP’s handshake.
CLDAP grows 580% and revives an old amplification technique
The most notable increase belongs to CLDAP Flood, which rose by 580% between Q1 and Q2 and became the third most common network attack vector during the last period.
CLDAP is a connectionless variant of LDAP that uses UDP. When certain services are exposed to the Internet, they can be exploited as reflectors.
The attacker sends a small query using a spoofed source IP of the target. The exposed server then responds with a much larger response directly against the victim.
From an infrastructure perspective, the growth of CLDAP echoes a known issue: DDoS attacks rely not only on millions of compromised IoT devices.
Incorrectly exposed UDP services continue to offer reflection and amplification mechanisms capable of turning legitimate Internet resources into involuntary attack participants.
For sysadmins and network operators, reducing this surface involves reviewing exposed services, applying filtering, and preventing systems that should never accept public traffic from being used as amplifiers.
Geopolitics, hacktivism, and DDoS attacks intertwining
Cloudflare also detects shifts in targeted sectors coinciding with international events.
Media, production, and publishing sat in first place during both quarters, accounting for 14.2% of mitigated HTTP DDoS requests.
One of the most significant movements was in the government sector, which moved from position 29 in Q1 to ninth place in Q2.
The report associates this rise with Operation Epic Fury and increased campaigns claimed by hacktivist groups. In the 72 hours following the start of operations against Iran, security researchers logged claims for 149 attacks targeting 110 organizations across 16 countries.
It’s important to distinguish correlation from attribution. An attack coinciding with a conflict does not necessarily reveal who carried it out, especially since botnets distribute traffic across devices in multiple countries.
Similarly, interpreting the geographic origin of attacks requires caution.
During the semester, Brazil emerged as the primary source of DDoS traffic mitigated by Cloudflare, with 14.9%, ahead of the United States at 13.4%. In Q2, Brazil’s attributed share increased to 21.4%.
This does not imply that one-fifth of attackers are physically located in Brazil. Instead, it indicates the observed origin of traffic, which may involve servers, routers, compromised IoT devices, or other systems elsewhere.
23.2 million attacks reveal the real scale problem
Attacks exceeding 1 Tbps draw attention, but for infrastructure operators, another figure may be more crucial: 23.2 million network layer attacks in six months.
The industrialization of DDoS involves combining botnets, compromised infrastructure, amplification techniques, and commercial attack-as-a-service offerings.
Law enforcement agencies are also working to reduce this availability. The international PowerOFF operation targeted on-demand DDoS platforms, with authorities from 21 countries participating. Europol reported over 75,000 identified users, 53 deactivated domains, 25 records, and four arrests.
Cloudflare recorded its monthly peak in April, with 6.46 trillion requests and 165 PB of DDoS volume, followed by a decline that possibly relates to that police operation. The company notes this as a possibility, not as a proven causal link.
For the Internet infrastructure, the first half of 2026 presents a scenario with two extremes.
On one hand, launching relatively small attacks is accessible to more actors. On the other, botnets and amplification techniques are pushing the top volume market toward several Tbps.
The technical challenge now goes beyond just having a sufficiently large connection. DDoS defense is becoming a distributed problem of capacity, routing, filtering, and automation, where detection must occur close to the source and before the traffic reaches the most limited components of the infrastructure.
Frequently Asked Questions
How many attacks over 1 Tbps did Cloudflare detect?
Cloudflare states it mitigated 935 network layer attacks over 1 Tbps during the first half of 2026, with 805 occurring in the second quarter.
Why can a short DDoS attack be dangerous?
Because it can saturate links or network equipment before manual intervention is possible. Cloudflare indicates that 90.6% of observed attacks lasted less than ten minutes.
What is the difference between DNS Flood and DNS Amplification?
A DNS Flood attempts to saturate DNS servers directly by flooding them with queries. DNS Amplification uses third-party DNS servers and spoofed IP addresses to multiply traffic directed toward the victim.
What does it mean if a country is shown as the origin of DDoS attacks?
It indicates where the traffic was observed arriving from, not necessarily where the attacker is located. Botnets may use compromised devices across multiple countries.
