Cloudflare 2026 DDoS Threat Report: 1 Tbps Attacks on the Rise
DNS floods and geopolitical tensions trigger a new wave of cyber assaults
1The 1 Tbps Club Expands
Cloudflare mitigated 935 network-layer DDoS attacks exceeding 1 Tbps in H1 2026, with a 519% quarter-over-quarter surge between Q1 and Q2. DNS-based attacks accounted for 34.3% of all network-layer activity, while DNS Floods alone jumped from 25.7% to 40%. CLDAP Floods surged 580% to become the #3 vector in Q2, highlighting shifting attack methodologies in the cyber threat landscape.
2Geopolitical Ripple Effects
The Media & Publishing sector became the most attacked industry (14.2% of mitigated HTTP DDoS requests) due to coverage of Iran, Ukraine, and the World Cup. Turkey rose to #3 most-attacked country ahead of the July NATO Summit in Ankara. The Government sector made the largest single rank jump of 2026 (#29 to #9) during Operation Epic Fury, reflecting how global events shape cyber warfare patterns.
35,300 Attacks Per Hour
Cloudflare's infrastructure blocked 23.2 million network-layer and 29.64 trillion HTTP DDoS requests in H1 2026 - equating to approximately 5,343 attacks per hour or 128,000 daily. April 2026 set records with 6.46 trillion requests and 165 petabytes of traffic - equivalent to a major video platform's daily data processing capacity. These figures demonstrate the unprecedented scale of modern DDoS threats.
4Law Enforcement Crackdown
Operation PowerOFF, a 21-country coordinated action, targeted over 75,000 DDoS-for-hire users, resulting in 53 domain takedowns, 25 search warrants, and 4 arrests. This intervention correlated with a subsequent decline in attack volumes. However, hyper-volumetric attacks (>1 Tbps) still increased six-fold in Q2 (805 incidents), showing the complex dynamics of cybercrime enforcement.
5Short but Devastating
96.62% of mitigated network-layer attacks in H1 2026 were under 500 Mbps, and 90.60% lasted less than 10 minutes. Attackers increasingly mix layers - combining high packet rates with low bandwidth or vice versa - to exploit different network vulnerabilities. Even 'small' attacks have real impact: 100 Mbps can overwhelm a server, while 100 Gbps can take down unprotected data centers.
6Impact in Seconds
The largest hyper-volumetric attacks often complete in seconds - some record-breaking assaults lasted just 35 seconds. This leaves no practical window for human intervention. However, the cascading effects - routing instability, TCP retransmissions, and service degradation - can persist for days. The brief duration but lasting damage makes automated protection essential rather than optional.
7Operation Epic Fury Fallout
Within 72 hours of Operation Epic Fury's launch on February 28, 2026, security researchers recorded 149 hacktivist DDoS claims against 110 organizations across 16 countries. Government entities comprised 47.8% of targets, causing the sector to jump 20 places in attack rankings (#29 to #9). This demonstrates how kinetic military actions increasingly trigger parallel cyber campaigns with distinct characteristics.
8Automation Becomes Mandatory
The 2026 DDoS landscape proves manual mitigation solutions are obsolete. Attacks combining brevity, sophistication, and geopolitical motivations require always-on, automated defenses. Cloudflare's data shows these systems become particularly critical during periods of international tension. With current trends, H2 2026 is likely to see continued escalation in both attack volumes and their real-world consequences.
Original article: Cloudflare Blog — Cloudflare 2026 DDoS Tehdit Raporu: 1 Tbps Saldırılarında Artış