Cloudflare Mitigates 23.2 Million DDoS Attacks as 1 Tbps Attacks Surge 519%

Cloudflare has mitigated 23.2 million network-layer DDoS attacks and stopped 29.64 trillion HTTP DDoS requests during the first half of 2026.

This underscores a significant increase in both the frequency and intensity of Internet-scale attacks. The company’s latest DDoS Threat Report, produced by its Cloudforce One threat intelligence team, combines data collected from January to June 2026.

The figures translate to approximately 5,343 network-layer attacks per hour, or about 128,000 per day. The data shows that attackers are increasingly capable of launching hyper-volumetric campaigns at speeds and scales that leave little room for manual incident response.

Cloudflare Mitigates 23.2 Million DDoS Attacks

One of the most striking trends is the growth of the “1 Tbps club.” Cloudflare mitigated 935 network-layer attacks exceeding one terabit per second during the first half of 2026, with 805 of those attacks occurring in the second quarter alone.

This represents a 519% increase over the previous quarter, more than six times the number observed in Q1. Hyper-volumetric attacks are campaigns that exceed 1 Tbps (1 billion packets per second) or 1 million requests per second.

Although these events often last only a few seconds, their impact can be severe, leading to congestion, routing instability, TCP retransmissions, application timeouts, and prolonged downstream degradation.

Despite the rise in massive attacks, most campaigns remained relatively short and low-bandwidth. Cloudflare reported that 96.62% of network-layer attacks stayed below 500 Mbps, while 90.60% ended within ten minutes.

Nonetheless, even “small” attacks can overwhelm organizations with limited bandwidth or poorly protected infrastructure. For instance, a 100 Mbps attack can disrupt a server or website.

In contrast, a 100 Gbps attack can incapacitate many unprotected data centers. This inconsistency between attack duration and operational impact underscores the need for automated, always-on mitigation rather than human-operated or on-demand defenses.

DNS-based activity emerged as the dominant network-layer threat category, accounting for 34.3% of attacks in the first half of the year. DNS floods alone increased from 25.7% of network-layer activity in Q1 to 40% in Q2.

Attackers use DNS floods to overwhelm authoritative DNS infrastructure with high volumes of raw queries, potentially preventing users from resolving a domain and accessing services that depend on it.

DNS amplification attacks operate differently, leveraging open resolvers and spoofed source addresses to convert small requests into larger responses directed at a victim.

Meanwhile, CLDAP floods surged by 580% from the previous quarter, becoming the third-largest attack vector in Q2, reflecting continued exploitation of exposed UDP-based directory services.

Geopolitical developments also influenced targeting patterns. The Media, Production, and Publishing sectors remained the most attacked, accounting for 14.2% of all mitigated HTTP DDoS requests, as global attention focused on Iran, Ukraine, and the World Cup.

Government organizations saw the largest sector-ranking shift of the year, moving from 29th place in Q1 to 9th in Q2 amid Operation Epic Fury and related hacktivist activity. By the end of Q2, China became the most attacked location, followed by the United States.

At the same time, Turkey climbed to third place as attacks increased before the Ankara NATO Summit. Interestingly, Brazil emerged as the leading source country for DDoS attacks, surpassing the United States.

April marked the peak of DDoS activity, with Cloudflare recording 6.46 trillion malicious requests and 165 PB of attack traffic. Activity declined afterward, likely influenced by Operation PowerOFF, a multinational law enforcement action targeting DDoS-for-hire users and infrastructure.

Cloudflare emphasized that its globally distributed network, operating in more than 330 cities with a capacity of 500 Tbps, is designed to detect and mitigate attacks autonomously. For defenders, the report sends a clear message: DDoS attacks are becoming more automated, reflection-driven, and responsive to geopolitical events, making continuous protection essential.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world