Cloudflare DDoS Threat Report H1 2026: Surge in 1Tbps Attacks… DNS Floods and Geopolitical Tensions Spark New Wave

Cloudflare released a report analyzing DDoS threat trends from January to June 2026. In the first half, it mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion HTTP DDoS requests, with approximately 5,343 network-layer attacks occurring per hour.

Mega-attacks exceeding 1Tbps totaled 935 in the first half. Notably, 805 occurred in Q2, a 519% increase over the previous quarter, and hyper-volumetric attacks exceeding 1Tbps, 1Bpps, and 1Mrps increased more than sixfold.

The center of attack methods also shifted from botnet floods to reflection and amplification attacks.

• DNS-based attacks accounted for 34.3% of all network-layer attacks.
• DNS floods increased from 25.7% in Q1 to 40.0% in Q2.
• CLDAP floods surged 580% quarter-over-quarter, becoming the third most common attack vector in Q2.

April was the peak month for DDoS activity, recording 6.46 trillion attack requests and 165PB of traffic. The subsequent decline in attack volume and traffic may have been influenced by Operation PowerOFF, which targeted over 75,000 users of DDoS-for-hire services with the participation of 21 countries. This operation resulted in the seizure of 53 domains, the execution of 25 search warrants, and the arrest of 4 individuals.

Geopolitical tensions and international events also affected the distribution of attack targets. The media, production, and publishing sectors accounted for 14.2% of all HTTP DDoS requests for two consecutive quarters, making them the most attacked industry, influenced by coverage related to Iran and Ukraine, and World Cup broadcasts. Turkey became the third most attacked country ahead of the NATO Summit in Ankara, and the government sector rose from 29th to 9th place during Operation Epic Fury.