Cloudflare DDoS Threat Report H1 2026: 1 Tbps Attacks Surge as DNS Floods and Geopolitics Reshape the Landscape

The 25th edition of Cloudflare’s DDoS Threat Report marks a strategic shift to a semi-annual publication cycle. This volume aggregates telemetry from Q1 and Q2 of 2026, providing a comprehensive analysis of the threat landscape through the first half of the year. The data and insights presented are authored by Cloudforce One, Cloudflare’s dedicated threat intelligence organization, and are derived directly from traffic observed across Cloudflare’s global network infrastructure.

The report highlights several critical shifts in attack methodologies and motivations:

• Hyper-Volumetric Surges: The “1 Tbps club” has expanded significantly, with 935 network-layer attacks exceeding 1 Tbps mitigated in the first half of the year—a 519% increase between Q1 and Q2.
• DNS-Centric Tactics: DNS-based attacks now account for 34.3% of all network-layer activity. DNS Floods, which attempt to exhaust the query capacity of authoritative DNS servers, rose to represent 40% of network-layer attacks in Q2.
• Geopolitical Influence: Global events—including media coverage of conflicts in Ukraine and Iran, the World Cup, and the NATO Summit in Ankara—have directly correlated with localized and industry-specific surges. Notably, the government sector experienced a massive shift in attack ranking following the onset of Operation Epic Fury.

Engineering teams must distinguish between the varying mechanisms used in modern DDoS campaigns. For instance, while DNS Floods target the "phonebook" of a domain to exhaust query capacity, reflection and amplification vectors—such as the 580% quarter-over-quarter surge in CLDAP (Connectionless Lightweight Directory Access Protocol) Floods—abuse UDP-based services to bounce massive payloads off third-party infrastructure onto a target.

Despite the rise in hyper-volumetric events, 96.62% of network-layer attacks remain under 500 Mbps and 90.60% conclude within 10 minutes. However, these "small" attacks are sufficient to overwhelm non-hardened infrastructure. Because these bursts often last mere seconds, human-in-the-loop mitigation is technically infeasible. Consequently, automated, always-on protection is the only effective defense against the rapid, cascading effects of these transient but impactful events.

Hyper-volumetric DDoS attacks—those exceeding 1 terabit per second (Tbps), 1 billion packets per second (Bpps), or 1 million requests per second (Mrps)—are no longer exceptional. In H1 2026, Cloudflare mitigated 935 network-layer attacks above 1 Tbps. The quarter-over-quarter surge between Q1 and Q2 reached +519%, with 805 attacks over 1 Tbps in Q2 alone, a more than six-fold increase over the prior quarter.

H1 totals reached 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests, roughly 5,343 network-layer attacks per hour. April 2026 peaked at 6.46 trillion requests and 165 PB. Volumes declined afterward, a possible reflection of Operation PowerOFF—a 21-country action targeting over 75,000 DDoS-for-hire users, with 53 domains taken down, 25 search warrants, and four arrests.

Despite hyper-volumetric growth, 96.62% of network-layer attacks stayed under 500 Mbps, and 90.60% ended within 10 minutes; some record-breaking assaults last only 35 seconds. Human response is impossible—by the time an alert reaches an analyst, the attack is already complete. Aftershocks persist: routing instability, TCP retransmissions, application timeouts, and downstream degradation lasting hours or days. Attackers also mix layers, pairing high packet rates with low bandwidth or vice versa to exploit weaknesses in network gear versus bandwidth capacity.

Practical thresholds:

• A 100 Mbps attack can overwhelm a single server.
• A 100 Gbps attack can knock most unprotected data centers offline.
• A 1+ Tbps attack stresses even major Internet infrastructure.

Vector dynamics explain the surge. DNS-based attacks accounted for 34.3% of network-layer activity in H1 2026; DNS Floods rose from 25.7% to 40.0% quarter-over-quarter. CLDAP Floods—amplification via spoofed LDAP-over-UDP queries to domain controllers on port 389, with responses tens to hundreds of times larger than the query—grew +580% to become the #3 vector in Q2.

Automated, always-on mitigation is a necessity, not a convenience. Manual and on-demand defenses lack the latency profile for sub-ten-minute, hyper-volumetric events; filtering must run inline at the network edge, distinguishing legitimate traffic from reflection floods without human latency.

The attack-vector landscape has shifted decisively from direct botnet floods toward reflection and amplification techniques. In the first half of 2026, DNS-based attacks—encompassing both DNS Floods and DNS Amplification—accounted for 34.3% of all network-layer activity. The composition within that category changed sharply: DNS Floods alone climbed from 25.7% to 40.0% of network-layer attacks quarter-over-quarter, indicating that attackers are concentrating raw query volume on authoritative infrastructure rather than relying solely on amplification.

These two mechanisms are frequently conflated but are technically distinct:

• DNS Flood: A botnet directs raw query volume directly at a victim's authoritative DNS servers to exhaust query-processing capacity. No spoofing or amplification is required; the botnet's aggregate request rate is the weapon. When the authoritative servers are saturated, the domain's resolution fails, and every dependent service becomes unreachable.
• DNS Amplification: An attacker sends small, spoofed queries to open DNS resolvers, which respond with much larger records—often triggered by ANY queries—to the victim's spoofed source IP. The attacker's bandwidth is multiplied by the response-size factor, and the open resolver becomes the unwitting amplifier.

Beyond DNS, Connectionless Lightweight Directory Access Protocol (CLDAP) Floods surged +580% quarter-over-quarter, making CLDAP the #3 vector in Q2. CLDAP is a UDP-based variant of LDAP, used for querying directory services over IP networks. Because UDP requires no handshake, attackers can spoof source IP addresses; small queries sent to publicly reachable domain controllers on UDP port 389 elicit responses tens to hundreds of times larger than the original query, directing that amplified traffic at the spoofed victim.

For defensive architecture, the operational implications are concrete: rate-limit and monitor authoritative DNS query patterns; sinkhole or filter known amplification sources; restrict or disable UDP 389 exposure on domain controllers where feasible; and deploy automated, always-on mitigation. Manual response is impractical—90.60% of network-layer attacks end in under 10 minutes, meaning by the time an alert reaches an analyst, the attack has already completed.

Geopolitical events are a measurable driver of DDoS attack patterns. On February 28, 2026, Israel and the United States launched Operation Epic Fury, a series of strikes against Iran’s leadership and infrastructure. Within 72 hours, researchers recorded 149 hacktivist DDoS claims against 110 distinct organizations across 16 countries. Nearly 47.8% of targeted organizations belonged to the government sector. The sector’s share of mitigated HTTP DDoS requests jumped from #29 in Q1 to #9 in Q2, the largest single industry-rank movement of 2026 to date.

Two other patterns illustrate the relationship between global events and attack activity. Media, Production & Publishing was the most-attacked industry in both Q1 and Q2, absorbing 14.2% of all mitigated HTTP DDoS requests, nearly four times the runner-up. Coverage of Iran, Ukraine, and the World Cup sustained this attention. Separately, Turkey rose to the #3 most-attacked country in Q2, more than doubling its share of global attack traffic amid the Ankara NATO Summit. These shifts indicate that conflict triggers attacks not only against direct participants, but also against media outlets covering the events and host nations of major diplomatic gatherings.

For enterprise defenders, the pattern has practical implications. DDoS campaigns can mobilize within hours, target organizations outside the immediate conflict zone, and arrive as short-duration bursts; in H1 2026, 90.60% of network-layer attacks ended in under 10 minutes, leaving no practical manual reaction window.

• Incorporate geopolitical calendars into DDoS readiness planning; anticipate spikes during military actions, summits, or major media events.
• Ensure always-on, automated mitigation is in place for public-facing government, media, and event-related infrastructure.
• Validate reported hacktivist claims for attribution, as not all claims are confirmed or equally impactful.

These steps do not prevent attacks, but they align defensive posture with the operational tempo of politically motivated DDoS activity.

Network-layer attacks present a deceptively asymmetric profile. In observed telemetry, 96.62% of network-layer attacks remained below 500 Mbps, and 90.60% concluded within ten minutes. These figures can mask real danger: "small" is relative to the target. A sustained 100 Mbps flood is sufficient to saturate the connection queue and CPU of an unprotected web server, exhausting worker processes and forcing connection resets. At the opposite extreme, a 100 Gbps volumetric attack can saturate uplinks and switch fabric, taking most unprotected data centers fully offline. Between these bounds, attackers may also combine low bandwidth with high packet rates to exhaust routing and firewall processing capacity rather than link utilization.

Duration compounds the problem. While the median attack is short-lived, the largest observed events can complete in as little as 35 seconds. This creates a critical operational constraint: there is no practical window for human intervention. By the time an alert reaches a security analyst, the attack has already finished. Manual mitigation runbooks, on-demand scrubbing centers, and traffic rerouting decisions are all too slow to respond within this envelope.

The consequences of a brief attack outlast the attack itself. A short burst can still trigger cascading failures:

• Routing instability as BGP peers withdraw or flap under load.
• TCP retransmission storms and connection timeouts at intermediaries.
• Application-layer timeouts that corrupt session state and shared caches.
• Downstream service degradation persisting for hours or days.

Because detection and mitigation must occur within seconds, automated, always-on protection is a structural requirement, not an operational convenience. Effective systems continuously profile baseline traffic, detect anomalies via statistical and signature-based methods, and enforce mitigation programmatically at the network edge without requiring human approval. This approach does not eliminate the need for security teams; it refocuses them on policy, tuning, and post-incident analysis rather than real-time triage.

DDoS attack geography has two separate dimensions: where the target infrastructure resides and where the attack traffic originates. In the most recent quarter, China was the most-attacked location, absorbing 22.4% of all global HTTP DDoS requests. The United States followed at 18.8%, while Turkey rose to third place as its share of attack traffic more than doubled, coinciding with the NATO Summit in Ankara. These rankings reflect observed mitigated request volume across a global edge network; a location ranks highly because it hosts attractive targets, not necessarily because of regional attacker demographics. That distinction matters when prioritizing mitigation capacity: engineers should assess exposure by destination, not by presumed threat origin.

Source countries tell a different operational story. Brazil overtook the United States as the top DDoS source country, contributing 14.9% of mitigated DDoS request traffic versus 13.4%, and surged to 21.4% in the second quarter. Indonesia remained the third-ranked source. High source-country volume typically indicates botnet population density, open resolvers, or unpatched services usable for reflection and amplification. Context reinforces the point: DNS Floods and DNS Amplification combined for 34.3% of network-layer attacks, and CLDAP reflection grew sharply as a vector, so filtering by source country alone is insufficient.

Practical defense guidance follows from the attack profile:

• Most network-layer attacks are small and brief: 96.62% stayed under 500 Mbps and 90.60% ended within 10 minutes.
• Impact scales nonlinearly: 100 Mbps can overwhelm a single server; 100 Gbps can knock an unprotected data center offline; attacks above 1 Tbps now occur regularly.
• Record-breaking attacks above 1 Tbps have lasted as little as 35 seconds, making manual response impossible; always-on automated mitigation is required.

Cloudflare operationalizes this at scale: free, unmetered DDoS protection runs in every one of its 330+ cities, backed by 500 Tbps of network capacity. To help dismantle the infrastructure that generates these attacks, the DDoS Botnet Threat Feed for Service Providers shares abusive IP addresses and accounts with hosting providers, cloud platforms, and ISPs; over 800 networks worldwide subscribe.