Cloudflare Inc. reported today that distributed denial-of-service attacks above 1 terabit per second grew sixfold between the first and second quarters of 2026, to 805 from 130.

That took the half-year total to 935 attacks over 1 Tbps, against 219 in the fourth quarter of last year. Cloudflare said in the report that attackers now deliver attacks of that size “at a cadence measured in hundreds per quarter.”

The numbers come from the 25th edition of the company’s DDoS Threat Report. This one covers January through June, the first time Cloudflare has folded two quarters into a single volume. Its threat intelligence team, Cloudforce One, built the analysis from traffic crossing Cloudflare’s own network.

Network-layer attacks mitigated over the six months totaled 23.2 million. At the application layer, the company counted 29.64 trillion HTTP DDoS requests. Cloudflare put the pace at 5,343 network-layer attacks an hour, roughly 128,000 a day. Attack traffic absorbed more than half, running to about 1.23 exabits.

Most attacks remain small and quick. Some 97% of network-layer attacks stayed under 500 Mbps. Nine in 10 of all network-layer attacks were over inside 10 minutes. Duration is where that breaks down. Attacks lasting more than three hours numbered 108,976 in the second quarter. Three months earlier the figure had been 38,865.

The mix of techniques also shifted. DNS-based attacks, covering DNS Flood and DNS Amplification, made up 34% of network-layer activity across the six months. DNS Flood did most of that work, accounting for 40% of network-layer attacks in the second quarter, well up on its 26% share in the first.

The two work differently. A DNS Flood aims a botnet’s raw request volume at a victim’s authoritative servers. Amplification bounces small spoofed queries off open resolvers, which answer with far larger records.

The sharpest move came from CLDAP Flood, an amplification attack against the Connectionless Lightweight Directory Access Protocol that Active Directory domain controllers answer on UDP port 389. The vector jumped 882% quarter-over-quarter to become the third most common by the second quarter. Older vectors faded over the same period. SSDP Flood dropped 87% and SNMP Flood fell 89%. Mirai’s share of attacks halved.

Geopolitics shaped much of the rest. Israel and the U.S. launched Operation Epic Fury on Feb. 28, a series of strikes against Iranian leadership and infrastructure. Security researchers logged 149 hacktivist DDoS claims against 110 organizations in 16 countries within 72 hours of the strikes. Government bodies accounted for 48% of the organizations targeted worldwide.

The government numbers showed up in Cloudflare’s own rankings. The sector climbed 20 places, from 29th in the first quarter to ninth in the second, by share of mitigated HTTP DDoS requests. Cloudflare called it the largest single sector movement of 2026 so far.

Media, production and publishing held the top spot in both quarters, taking 14% of all mitigated HTTP DDoS requests for the half. That is nearly four times the runner-up, gambling and casinos. The vertical’s share nearly tripled between quarters, to 21% from 7%, as coverage of Iran, Ukraine and the World Cup drew sustained attention.

China reclaimed the most-attacked position in the second quarter with 22% of global HTTP DDoS requests, pushing the U.S. into second at 19%. Attacks aimed at Turkey more than doubled as a share of global traffic, taking the country to third by the second quarter, a rise Cloudflare linked to tensions around the NATO summit Turkey was preparing to host in Ankara. Turkish security forces ran sweeping raids across the city ahead of the summit and arrested at least 209 people.

On the sending side, Brazil overtook the U.S. as the largest source of attack traffic for the half, at 15% against 13%. A second-quarter surge did it, taking the country to 21% of mitigated DDoS request traffic. Indonesia stayed locked at third in both quarters.

April was the peak month, at 6.46 trillion HTTP DDoS requests and 165 petabytes of network-layer attack traffic. Both measures declined afterward. Cloudflare said the fall may reflect Operation PowerOFF, the 21-country law enforcement action against booter and stresser services that targeted more than 75,000 DDoS-for-hire users, took down 53 domains and led to four arrests.

Cloudflare offers hosting providers and internet service providers a free botnet threat feed so they can find the addresses and accounts launching these attacks. More than 800 networks have signed up.

Image: SilconANGLE/GPT Image 2