# Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave

[Cloudflare](https://yomu.fyi/company/cloudflare) · Cloudforce One · Aug 11, 2026

**Type:** Explainer

## Summary

In the first half of 2026, network-layer DDoS attacks exceeding 1 Tbps surged by 519% quarter-over-quarter, with 935 mitigated attacks recorded across the period. Threat actors shifted their focus toward reflection and amplification methods, making DNS-based floods and CLDAP floods the dominant vectors. Despite the rise in hyper-volumetric traffic, 96.62% of network-layer attacks remained under 500 Mbps and 90.60% ended in under 10 minutes. Geopolitical conflicts and international events heavily influenced target selection, pushing the Media, Production & Publishing industry to the top position. Because brief multi-gigabit bursts trigger downstream routing instability and application timeouts before analysts can respond, automated, always-on edge mitigation has become critical.

## Context

DDoS attacks are rapidly escalating in volume and shifting toward amplification techniques such as DNS and CLDAP floods, while geopolitical tensions and major global events drive targeted surges against government and media organizations.

## Approach / What changed

Cloudflare deploys automated, unmetered DDoS mitigation across 330+ edge locations with 500 Tbps of network capacity and distributes a free DDoS Botnet Threat Feed to over 800 service provider networks to facilitate botnet takedowns.

## Takeaways

- Network-layer DDoS attacks surpassing 1 Tbps jumped 519% quarter-over-quarter in H1 2026, totaling 935 hyper-volumetric mitigations.
- DNS-based attacks accounted for 34.3% of network-layer activity in H1 2026, while CLDAP reflection floods grew 580% quarter-over-quarter.
- Although hyper-volumetric attacks increased, 96.62% of network-layer attacks stayed below 500 Mbps and 90.60% finished within 10 minutes.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Monitoring](https://yomu.fyi/topic/monitoring), [Reliability](https://yomu.fyi/topic/reliability)

[Read original post](https://blog.cloudflare.com/ddos-threat-report-2026-h1)