Cloudflare DDoS Report H1 2026: 1 Tbps Attacks Soared as DNS Floods Became the Leading Vector

Cloudflare published its 25th DDoS Threat Report today, and for the first time the company combined Q1 and Q2 into a single half-year edition covering January through June 2026. The headline numbers are worth the read: the network-layer picture flipped from botnet floods toward reflection and amplification, hyper-volumetric attacks grew more than six-fold in a single quarter, and the median attack stayed small and short even as the top end went vertical.

This is a data report, not a feature launch, but it is the clearest signal this year on what attackers are actually spending their compute on. The takeaways matter to any developer who runs public infrastructure, because the report's threshold numbers show how little bandwidth it takes to hurt you.

What the data shows#

The report, produced by Cloudflare's Cloudforce One threat-intelligence team from network telemetry, has four headline movements.

Hyper-volumetric attacks entered a new cadence. Cloudflare mitigated a combined 935 network-layer attacks exceeding 1 Tbps in the first half of 2026, with an 805-attack second quarter representing a more than six-fold increase over Q1. The overall 1 Tbps club grew +519% quarter-over-quarter. A 1+ Tbps attack, the report notes, "stresses even major Internet infrastructure."

Reflection and amplification replaced botnet floods as the center of gravity. DNS-based attacks accounted for 34.3% of all network-layer activity in H1. DNS floods specifically climbed from 25.7% to 40.0% of network-layer attacks quarter-over-quarter. CLDAP floods - reflection attacks that abuse exposed Active Directory LDAP-over-UDP endpoints on port 389 - surged +580% to become the #3 vector in Q2. CLDAP is connectionless and uses UDP, so attackers can spoof source IPs and get amplification of tens to hundreds of times from publicly reachable domain controllers.

Volume is still climbing. Cloudflare says it mitigated 23.2 million network-layer and 29.64 trillion HTTP DDoS requests in H1, roughly 5,343 network-layer attacks per hour, or about 128,000 per day. April was the peak month at 6.46 trillion requests and 165 petabytes of attack traffic, which the report attributes in part to the effect of geopolitical campaigns. Declines after April line up with Operation PowerOFF, a 21-country law-enforcement action that targeted over 75,000 DDoS-for-hire users, took down 53 domains, and made four arrests.

Most attacks are still small and short. 96.62% of network-layer attacks stayed under 500 Mbps and 90.60% ended within 10 minutes. Record-breaking assaults have lasted as little as 35 seconds. The report's operational framing: a 100 Mbps attack is enough to overwhelm a server or website, a 100 Gbps attack can knock most unprotected data centers offline, and there is no practical window for manual mitigation once an alert fires.

Why this matters to developers#

Two details in this report are more useful than the macro numbers.

First, the duration stat is an architectural argument. If 90.60% of attacks end in under 10 minutes and the largest finish in 35 seconds, human-scale response is a design fiction. By the time a pager fires, the attack is over. The damage is the aftershock: routing instability, TCP retransmissions, application timeouts, and degraded service that can last hours or days after the burst stops. That means always-on, automated mitigation is not a scale option, it is the baseline expectation, and it is exactly why the report pushes hard on autonomous, always-on protection and the free DDoS Botnet Threat Feed for Service Providers, which now has over 800 networks subscribed.

Second, the CLDAP surge is a reminder that the attack surface includes services you may not think of as Internet-facing. Amplification vectors only work when there are exposed resolvers and directory endpoints to abuse. The same exposure class that made open DNS resolvers a liability a decade ago is now finding your Active Directory domain controllers if UDP 389 is reachable from the outside. If you run infrastructure, an exposed-services audit is a direct DDoS defense, not a hygiene chore.

The mix matters too. DNS floods take down the phonebook, which means a service can be unavailable even when its origin is healthy. If you depend on any third-party nameserver or a provider whose edge absorbs this traffic, availability risk sits outside your own VPC. The report's most-attacked verticals make the same point from the other direction: Media, Production & Publishing took 14.2% of mitigated HTTP DDoS requests in both quarters, nearly four times the runner-up, and the Government sector jumped from #29 to #9 as hacktivist campaigns responded to Operation Epic Fury, with 149 claimed attacks against 110 organizations across 16 countries inside 72 hours.

How it fits the infrastructure picture#

The report sits alongside the other Cloudflare work we have covered this month, and the through-line is that the edge is becoming the security control plane. The identity-aware AI Gateway we covered last week extends the same always-on, network-positioned thinking to model traffic, and the agent-trust work on behavioral detection is the same autonomous-mitigation philosophy aimed at agent traffic. Cloudflare's Radar research agent is built on the same telemetry the DDoS report draws from. For a narrower view of one attacker-behavior pattern, our comparison of AI coding agent security models covers the threat-modeling side of running agent workloads on shared infrastructure.

If you take one thing from this report, make it the asymmetry: 96.62% of attacks need less than 500 Mbps to be a real problem, and most of them finish before a human can act. Architect for absorption, automate the response, and treat every exposed UDP and DNS service as a deliberate liability.

Continue Reading#

• Cloudflare Identity-Aware AI Gateway: What It Means for Multi-Tenant Model Access
• Cloudflare Radar Researcher: How Cloudflare's Agent Architecture Answers Questions
• AI Coding Agent Security Models Compared 2026
• Cloudflare Agent Trust: Behavioral Detection for Good and Bad Agentic Behavior
• AI Agent Containment Needs a Capability Ledger

Sources#

• Cloudflare DDoS Threat Report 2026 H1 (fetched 2026-08-11)