Terabit-scale DDoS attacks surge across Cloudflare network

Cloudflare observed a significant rise in terabit-scale distributed denial-of-service (DDoS) attacks on its network in the second quarter of 2026, with 805 attacks surpassing 1 terabit per second. This marked a six-fold increase from the 130 attacks recorded in the first quarter, bringing the total number of such attacks in the first half of the year to 935.

Overall network-layer DDoS attacks also grew substantially, with Cloudflare mitigating 13.17 million during the second quarter, up from 10.04 million in the first quarter. The total number of mitigated attacks reached 23.2 million for the first half, averaging about 128,000 per day or 5,300 per hour. The surge in DDoS activity extended beyond the 1 Tbps threshold, with attacks between 500 gigabits per second and 1 Tbps increasing 143% quarter over quarter, and those between 100 Gbps and 500 Gbps rising 105%.

Application-layer attacks were equally concerning, with Cloudflare handling approximately 29.64 trillion malicious HTTP requests in the first half of 2026, a 32.4% increase from the previous quarter. Most network-layer attacks remained relatively small, with 96.6% transmitting under 50 megabits per second, and about 90% lasting no more than 10 minutes.

However, the number of long-duration attacks increased, with over 108,000 lasting more than three hours, up from fewer than 39,000 in the first quarter. DNS-related techniques became a major component of the threat landscape, with DNS floods and DNS amplification accounting for nearly a third of network-layer attacks during the first half, rising to 40% during the second quarter.

CLDAP flooding saw an 882% increase quarter over quarter, becoming one of the most common attack vectors. The trend follows an even more extreme attack in 2025, where Cloudflare mitigated a 31.4 Tbps attack linked to the Aisuru/Kimwolf botnet. International tensions and major events also influenced the attack patterns, with government organizations becoming a larger target during the second quarter, and China emerging as the largest destination for mitigated HTTP DDoS traffic, followed by the United States and Turkey.