Cloudflare DDoS Threat Report H1 2026: 519% Surge in 1 Tbps Attacks, DNS Reflection, and Geopolitical Targeting

Cloudflare's 25th DDoS Threat Report for the first half of 2026 documents a dramatic escalation in the scale and sophistication of distributed denial-of-service attacks. The report highlights a 519% quarter-over-quarter surge in attacks exceeding 1 terabit per second (Tbps), a fundamental shift in attack vectors from botnet floods to reflection/amplification techniques, and intense geopolitical targeting of media organizations tied to the wars in Ukraine and Iran as well as the FIFA World Cup . Cloudflare mitigated a record 23.2 million network-layer DDoS attacks and 29.64 trillion HTTP DDoS requests in the first six months of 2026 .

The 1 Tbps Club Grows

The most striking finding is the explosion in the number of hyper-volumetric attacks. Cloudflare mitigated 935 network-layer DDoS attacks exceeding 1 Tbps in H1 2026, compared to just 219 in the fourth quarter of 2025 . The growth accelerated sharply from Q1 to Q2: 130 attacks over 1 Tbps were recorded in Q1, rising to 805 in Q2 — a sixfold increase . Some sources characterize this as a fivefold increase between those two quarters . Overall, the number of 1 Tbps attacks rose 519% quarter-over-quarter . Cloudflare notes that attackers now deliver attacks of this magnitude "at a cadence measured in hundreds per quarter" .

Despite this surge in the largest attacks, 2026 did not set new records for the size of individual attacks. That distinction belongs to 2025, when the record climbed from 5.6 Tbps in January to 31.4 Tbps in December . In H1 2026, April was the peak month, with Cloudflare clocking a maximum of 6.46 Tbps .

Shift in Attack Vectors: DNS and CLDAP Dominate

The report documents a clear shift in the center of gravity for attack vectors, moving away from botnet floods toward reflection and amplification techniques . DNS-based attacks — which include both DNS Flood and DNS Amplification — became the dominant vector, accounting for 34.3% of all network-layer activity in H1 2026 . DNS Floods alone climbed from 25.7% to 40.0% of network-layer attacks quarter-over-quarter . CLDAP Floods surged 580% quarter-over-quarter, becoming the third most common vector in Q2 . Cloudflare's own summary notes that these attacks were "driven heavily by DNS and CLDAP reflection vectors" .

Beyond volumetric attacks, the report also warns of a rise in precision Layer 7 attacks. These attacks produce no volumetric signal, making them invisible to detection logic tuned for bandwidth and packet rate. As a result, APIs remain a consistently unprotected surface, with misconfigured or absent rate-limit rules and incomplete WAF coverage leaving endpoints exposed .

Geopolitical Targeting: Media Under Fire

Geopolitical conflicts heavily shaped targeting patterns in H1 2026. Ongoing wars in Ukraine and Iran, along with the FIFA World Cup, drove a wave of geopolitically motivated DDoS attacks against media organizations . The media, production, and publishing sector was the most targeted industry, accounting for 14.2% of all DDoS attacks launched since January 1 . Over the first six months of the year, the sector saw nearly four times the number of attacks leveled at the second most targeted industry . The shifting geopolitical landscape fundamentally reshaped which countries and industries were most frequently targeted .

Record Overall Attack Volumes

Cloudflare's network mitigated 23.2 million network-layer DDoS attacks in H1 2026 — equivalent to roughly 5,343 attacks per hour, or about 128,000 per day . In addition, the company handled 29.64 trillion HTTP DDoS requests in the same period . These numbers continue a trend of year-over-year growth; in all of 2025, Cloudflare observed 47.1 million DDoS attacks, with network-layer attacks more than tripling year-over-year .

Law Enforcement Impacts

While the report and coverage of it mention law enforcement in the broader context of cyber threats, the available sources do not provide specific details on law enforcement actions or their impact on DDoS trends in H1 2026. The report's primary focus is on attack volumes, vectors, and geopolitical drivers.

Key Takeaways

• Hyper-volumetric DDoS attacks are becoming routine: 935 attacks exceeding 1 Tbps in H1 2026, with a 519% QoQ surge.
• Attackers have shifted from botnet floods to DNS and CLDAP reflection/amplification vectors, which now dominate network-layer activity.
• Geopolitical events — particularly the wars in Ukraine and Iran and the FIFA World Cup — are driving intense targeting of media organizations.
• Overall attack volume remains at record levels, with 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests mitigated in six months.
• The available sources do not detail specific law enforcement impacts on DDoS trends during this period.