Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave

Summary

In the first half of 2026, network-layer DDoS attacks exceeding 1 Tbps surged by 519% quarter-over-quarter, with 935 mitigated attacks recorded across the period. Threat actors shifted their focus toward reflection and amplification methods, making DNS-based floods and CLDAP floods the dominant vectors. Despite the rise in hyper-volumetric traffic, 96.62% of network-layer attacks remained under 500 Mbps and 90.60% ended in under 10 minutes. Geopolitical conflicts and international events heavily influenced target selection, pushing the Media, Production & Publishing industry to the top position. Because brief multi-gigabit bursts trigger downstream routing instability and application timeouts before analysts can respond, automated, always-on edge mitigation has become critical.

Takeaways

1. 1

   Network-layer DDoS attacks surpassing 1 Tbps jumped 519% quarter-over-quarter in H1 2026, totaling 935 hyper-volumetric mitigations.

2. 2

   DNS-based attacks accounted for 34.3% of network-layer activity in H1 2026, while CLDAP reflection floods grew 580% quarter-over-quarter.

3. 3

   Although hyper-volumetric attacks increased, 96.62% of network-layer attacks stayed below 500 Mbps and 90.60% finished within 10 minutes.