Cloudflare H1 2026 DDoS Report Highlights Sixfold Surge in 1 Tbps Attacks and Geopolitical Targeting

Cloudflare H1 2026 DDoS Report Highlights Sixfold Surge in 1 Tbps Attacks and Geopolitical Targeting In its H1 2026 DDoS Threat Report, Cloudflare documented tens of trillions of mitigated requests, marked by a sixfold surge in attacks exceeding 1 Tbps, widespread DNS and CLDAP vectors, and significant targeting shifts driven by geopolitical conflict. Cloudflare mitigated 23.2 million network-layer and 29.64 trillion HTTP DDoS requests in the first half of 2026, with attacks peaking in April before law enforcement disrupted major DDoS-for-hire operations. Network-layer attacks exceeding 1 Tbps increased more than sixfold in the second quarter, even as over 90% of all attacks concluded in under ten minutes and stayed below 500 Mbps. Geopolitical conflicts sparked heavy targeting shifts, pushing the government sector to ninth place following strikes on Iran and elevating Turkey to the third most-attacked nation ahead of the Ankara NATO Summit. DNS-based techniques made up 34.3% of network-layer attacks, while CLDAP reflection floods expanded by 580% quarter-over-quarter. Attack Volumes and Hyper-Volumetric Surge Across the first half of 2026, Cloudflare handled 23.2 million network-layer and 29.64 trillion HTTP DDoS requests, translating to roughly 128,000 network-layer attacks daily. Activity culminated in April with 6.46 trillion requests and 165 petabytes before ebbing, a decline Cloudflare notes may stem from Operation PowerOFF's international crackdown on over 75,000 DDoS-for-hire users. Despite the broader mid-year dip, hyper-volumetric threats escalated significantly: Q2 saw 805 network-layer attacks surpassing 1 Tbps, representing a more than sixfold increase compared to Q1. Brief Attack Durations Demand Automated Response Despite spikes in hyper-volumetric assaults, the typical attack remained modest in footprint and duration, with 96.62% of network-layer attacks staying below 500 Mbps and 90.60% terminating in under ten minutes. Attackers frequently combined high packet rates with lower bandwidth to strain hardware limits rather than pipe capacity. Cloudflare highlights that because major assaults often unfold in seconds—some lasting as little as 35 seconds—manual mitigation and on-demand security cannot respond in time to prevent cascading routing failures, timeouts, and multi-hour recovery periods. Geopolitical Drivers and Shifting Targets State conflicts and international gatherings heavily influenced attack patterns. Following US and Israeli strikes on Iran in February under Operation Epic Fury, hacktivists targeted 110 organizations across 16 countries within 72 hours, helping propel the government sector up 20 places to ninth among attacked verticals. Media, Production & Publishing remained the single most attacked industry overall at 14.2% of HTTP DDoS requests. Geographically, China and the United States absorbed the highest shares of attack traffic, while Turkey climbed to third amid security operations surrounding the Ankara NATO Summit. Brazil emerged as the top attack origin, followed by the United States and Indonesia. DNS Vectors, CLDAP Exploitation, and Defense DNS-based attacks, including direct query floods against authoritative nameservers and amplification using open resolvers, constituted 34.3% of network-layer incidents in H1. Simultaneously, CLDAP floods surged 580% quarter-over-quarter to become the third most common vector in Q2 by leveraging exposed Active Directory endpoints over UDP port 389 to magnify traffic directed at spoofed targets. To counteract these distributed threats, Cloudflare relies on automated mitigations across its 500 Tbps global network alongside a free botnet threat feed adopted by over 800 networks to take down abusive infrastructure.

Cloudflare发布2026年上半年DDoS威胁报告：1 Tbps以上超大规模攻击激增，DNS与CLDAP向量活跃 Cloudflare旗下情报机构Cloudforce One发布2026年上半年DDoS威胁报告。数据显示，上半年已缓解2320万次网络层攻击与29.64万亿次HTTP DDoS请求，4月为峰值月份；超过1 Tbps的超大规模攻击在第二季度环比增长超六倍，地缘政治冲突与大型活动驱动了针对政府、媒体等行业的攻击浪潮。 2026年上半年缓解2320万次网络层和29.64万亿次HTTP DDoS请求，4月单月达到峰值6.46万亿次请求及165 PB流量。 第二季度缓解了805次超过1 Tbps的网络层攻击，环比增幅逾6倍，但中位数攻击依然短小，96.62%低于500 Mbps，90.60%持续不到10分钟。 地缘政治引发明显波动：以美针对伊朗的行动促使政府行业被攻击排名从Q1的第29位跃升至Q2的第9位；中国和美国为前两大受攻击目标地，巴西超越美国成为最大攻击来源国。 DNS类攻击占网络层攻击的34.3%，CLDAP洪水攻击环比激增580%，成为第二季度第三大攻击向量。 攻击总体态势与规模演变 2026年上半年，Cloudflare平均每小时缓解约5,343次、每日约12.8万次网络层DDoS攻击。4月达到攻击活动与流量峰值后有所回落，报告认为这可能与打击DDoS租用服务的21国跨国联合执法行动有关。超大规模攻击显著增加，第二季度录得805次超过1 Tbps的攻击，环比激增逾六倍。然而，上半年攻击的中位数仍呈现短小特征，96.62%的网络层攻击低于500 Mbps，90.60%在10分钟内结束，部分超大规模攻击仅持续数十秒，使得人工干预难以奏效，全自动防护成为刚需。 地缘政治与重点受害行业 地缘冲突与国际事件深刻影响了攻击走势。2月美以对伊朗发起行动后，多国黑客行动主义声称发起149次DDoS攻击，直接推动政府机构在全球缓解HTTP DDoS请求中的排名在第二季度由第29位升至第9位。在战争与世界杯等背景下，媒体、制作与出版业成为上半年被攻击最多的行业，吸纳了14.2%的HTTP请求。中国在Q2吸收了22.4%的全球HTTP攻击流量，位居受攻击地首位，美国次之；土耳其因北约峰会前夕的安全行动导致受攻击份额翻倍升至第三位。攻击来源方面，巴西在Q2大幅飙升，上半年以14.9%的占比超过美国成为首要攻击来源国。 核心攻击向量与应对机制 基于DNS的攻击（DNS洪水与DNS放大）在上半年占网络层攻击的34.3%。利用UDP无握手特征进行反射放大的CLDAP洪水攻击环比增长580%，迅速跃居第二季度第三大向量，该向量通过向暴露在UDP 389端口的域控制器发送伪造源IP请求，产生数十至数百倍的放大响应。针对日益激增的高容量威胁，Cloudflare依靠其具备500 Tbps网络容量的自动化系统进行无人工干预缓解，并向服务商提供免费的僵尸网络威胁情报源，已有超过800个网络加入协助拆除僵尸网络节点。

Welcome to the 25th edition of Cloudflare's DDoS Threat Report. This is the first half-year edition in the series: rather than publishing separate reports for the first and second quarters of 2026, we have combined our coverage of Q1 and Q2 into a single volume covering January through June 2026. The analysis is produced by [Cloudforce One](https://www.cloudflare.com/cloudforce-one/), Cloudflare’s Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of [Distributed Denial of Service (DDoS) attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/) based on data from the [Cloudflare network](https://www.cloudflare.com/network/). Midway through the year, Cloudflare has already mitigated 23.2 million network-layer and 29.64 trillion HTTP DDoS requests. That works out to approximately 5,343 network-layer DDoS attacks per hour, or about 128,000 per day. April 2026 was a peak month for DDoS activity and volume, hitting a high of 6.46 trillion requests and 165 petabytes (PB) respectively. For perspective, this is an enormous amount of traffic — equivalent to streaming 4K video continuously for years, or roughly the amount of data processed by major video platforms in a single day. Requests and volumes declined afterward, a possible reflection of [Operation PowerOFF](https://www.europol.europa.eu/media-press/newsroom/news/europol-supported-global-operation-targets-over-75-000-users-engaged-in-ddos-attacks) — a 21-country action that targeted over 75,000 DDoS-for-hire users, took down 53 domains, issued 25 search warrants, and resulted in four arrests. Hyper-volumetric DDoS — attacks defined as exceeding 1 terabit per second (Tbps), 1 billion packets per second (Bpps), or 1 million requests per second (Mrps) — has been a growth category across Radar reporting. 2026 is proving to be no different. During the second quarter, Cloudflare mitigated 805 network-layer attacks exceeding 1 Tbps, representing a more than six-fold increase over the previous quarter. Despite the hyper-volumetric growth, the median DDoS attack Cloudflare mitigated in the first half of 2026 remained short and small with 96.62% of network-layer attacks remaining under 500 Mbps and 90.60% ending in under 10 minutes. It’s important to note, however, that ‘small’ is a relative term and most Internet properties wouldn’t be able to withstand even those small attacks. In practical terms: Attackers sometimes mix layers — a high packet rate (Mpps/Gpps) with relatively low bandwidth (Gbps), or vice versa, to exploit different weaknesses in network gear versus bandwidth capacity. Furthermore, most DDoS attacks are surprisingly short-lived, as highlighted in the chart below. Even the largest hyper-volumetric attacks can be measured in seconds rather than minutes — we have observed [record-breaking assaults that lasted only 35 seconds](https://blog.cloudflare.com/ddos-threat-report-for-2025-q1/#hyper-volumetric-attacks-continue-spill-into-q2) from start to finish. Whether an attack lasts half a minute or ten minutes, there is no practical window for human intervention: by the time an alert reaches a security analyst, the attack has already completed. Manual mitigation and on-demand solutions are simply too slow for this reality. Yet while the attack itself may be brief, its aftershocks are not. The cascading effects of even a short burst can trigger routing instability, TCP retransmissions, application timeouts, and downstream service degradation that takes hours or days to fully resolve — all while services remain down or impaired. In this threat landscape, automated, always-on protection is not a convenience; it is a necessity. On February 28, 2026, Israel and the United States launched Operation Epic Fury, a series of strikes against Iran’s leadership and infrastructure. Within 72 hours, the DDoS landscape responded, with [security researchers](https://thehackernews.com/2026/03/149-hacktivist-ddos-attacks-hit-110.html) recording 149 hacktivist DDoS claims against 110 distinct organizations across 16 countries. Nearly 47.8% of all targeted organizations globally belonged to the government sector. As public reporting documented extensive government targeting during this period, the vertical surged 20 places, from #29 in Q1 to #9 in Q2 by share of mitigated HTTP DDoS requests. While outside the top 10 for most of this period, it represented one of the single largest industry-rank moves. Amid warfare in Iran and Ukraine and the excitement of the World Cup, the Media, Production & Publishing industry was the most attacked in both quarters, taking 14.2% of all mitigated HTTP DDoS requests — nearly four times the runner-up. The DDoS landscape in H1 2026 saw both familiar names and reshuffling among the world's most-attacked locations. China ended H1 as the most attacked location, after absorbing 22.4% of all HTTP DDoS requests globally in Q2. The United States held firm at #2 (18.8%), demonstrating persistent appeal for attackers. Turkey saw a rapid increase in attacks, more than doubling its share of global attack traffic to climb into the #3 most-attacked position by Q2. The surge coincided with the buildup to the 2026 Ankara NATO Summit in June and early July, when Turkish security forces conducted [sweeping pre-summit raids](https://apnews.com/article/turkey-nato-summit-suspects-detained-864260d7cbe9ca73cd05115cd638ee93) across Ankara, arresting at least 209 people. Brazil overtook the United States as the top DDoS source country in the first half of 2026, at 14.9% versus 13.4% — driven by a dramatic Q2 surge when Brazil became the source country for 21.4% of all mitigated DDoS request traffic. Indonesia remained locked at #3 in both quarters — extending its multi-quarter run as one of the top three global DDoS source countries. DNS-based attacks ([DNS Flood](https://www.cloudflare.com/learning/ddos/dns-flood-ddos-attack/) and [DNS Amplification](https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/)) accounted for 34.3% of network layer attacks in the first half of 2026. The two mechanisms are related but distinct: a DNS Flood aims a botnet's raw request volume directly at a victim's authoritative DNS servers to exhaust their query capacity — the "phonebook" for that domain becomes unreachable and every service depending on it goes dark. DNS Amplification instead sends small [spoofed](https://www.cloudflare.com/learning/ddos/glossary/ip-spoofing/) queries to open [DNS resolvers](https://www.cloudflare.com/learning/dns/dns-server-types/), which reply with much larger records (often triggered by an ANY query) to the victim's spoofed IP. CLDAP Flood — a reflection and amplification vector that abuses exposed Active Directory LDAP-over-UDP endpoints — grew +580% quarter-over-quarter, becoming the #3 vector in Q2 alone. CLDAP ([Connectionless Lightweight Directory Access Protocol](https://datatracker.ietf.org/doc/html/rfc1798)) is a variant of LDAP ([Lightweight Directory Access Protocol](https://datatracker.ietf.org/doc/html/rfc4511)), used for querying and modifying directory services running over IP networks. CLDAP is connectionless, using UDP instead of TCP, making it faster but less reliable. Because it uses UDP, there’s no handshake requirement, which allows attackers to spoof the source IP address, thus allowing attackers to exploit it as a reflection vector. CLDAP attacks work by sending small spoofed queries to publicly reachable domain controllers on UDP port 389; the servers reply to the spoofed source (the victim) with responses tens to hundreds of times larger than the original query, thus overwhelming the victim host. Cloudflare's network is designed to absorb this kind of growth in DDoS threats. Every service on our network is protected by [free, unmetered DDoS protection](https://www.cloudflare.com/ddos/) that runs [at every one of our 330+ cities globally](https://www.cloudflare.com/network/), backed by 500 Tbps of network capacity. Autonomy is the point: our systems detect and mitigate attacks [without human intervention](https://developers.cloudflare.com/ddos-protection/about/), and they need to, because attackers now regularly deliver attacks above 1 Tbps at a cadence measured in hundreds per quarter. To help hosting providers, cloud computing platforms and Internet service providers identify and take down the abusive IP addresses/accounts that launch these attacks, we leverage Cloudflare’s unique vantage point on DDoS attacks to provide a [free DDoS Botnet Threat Feed for Service Providers](https://developers.cloudflare.com/ddos-protection/botnet-threat-feed/). Over 800 networks worldwide have signed up for this feed, and we’ve already seen great collaboration across the community to take down botnet nodes. Driven by a mission to help defend the Internet, [Cloudforce One](https://www.cloudflare.com/cloudforce-one/) draws on telemetry from Cloudflare's global network — which protects more than 20% of the web — to drive threat research and operational response, protecting critical systems for millions of organizations worldwide.