Cloudflare counted 23.2 million DDoS attacks in H1, including 935 above a terabit
Cloudflare’s H1 2026 DDoS report documents an explosion of hyper-volumetric attacks and reflection vectors built on DNS and CLDAP. Attacks now last seconds, which makes manual mitigation structurally obsolete.
August 11, 2026. Cloudflare published its DDoS Threat Report H1 2026, and the headline fits in one number: 23.2 million mitigated DDoS attacks over six months, or 5,300 every hour. Of those, 935 network-layer attacks exceeded 1 Tbps, up 519 % quarter-over-quarter. The vector center of gravity shifted from botnet floods to reflection and amplification, led by DNS floods and an exploding CLDAP protocol.
This is not a list of records. It documents a structural shift: the typical attack is becoming short and massive, and the window for human intervention is gone. That one point changes what “defending yourself” even means.
Attacks are bigger, but above all shorter
The most spectacular number is the rise of hyper-volumetric attacks — defined as exceeding 1 Tbps, 1 billion packets per second, or 1 million requests per second. In the second quarter alone, Cloudflare mitigated 805 network-layer attacks above a terabit, more than six times the previous quarter’s volume.
But the number that should wake up network teams sits elsewhere: 90.60 % of network-layer attacks end in under ten minutes, and 96.62 % stay under 500 Mbps. Cloudflare even reports record assaults that lasted only 35 seconds start to finish. The practical translation: by the time an alert reaches an analyst, the attack is already over.
That is the end of the “on-call sees the alert and reacts” model. A 35-second spike is not mitigated by hand; it is mitigated upstream, by always-on, automated protection. And the damage is not proportional to duration: a burst of a few seconds can trigger routing instability, TCP retransmissions, application timeouts, and degradation that takes hours to resolve.
The damage scale, in plain numbers
To calibrate the threat, Cloudflare offers a scale anyone can read:
- 100 Mbps is enough to overwhelm a server or a website;
- 100 Gbps takes down most unprotected data centers;
- 1+ Tbps ranks among the largest attacks ever recorded and stresses even major internet infrastructure.
Attackers also mix layers: high packet rates (Mpps/Gpps) with low bandwidth, or the reverse, to exploit different weaknesses — network gear on one side, transit capacity on the other. A defense that covers only one layer leaves the other exposed.
DNS and CLDAP: reflection takes over
The deeper change is the dominance of reflection and amplification vectors. DNS-based attacks (DNS floods and DNS amplification) accounted for 34.3 % of network-layer activity in the half-year, and DNS floods alone climbed from 25.7 % to 40.0 % of network-layer attacks quarter-over-quarter.
The mechanics are worth restating, because they sit at the heart of the report. A DNS flood points a botnet’s raw request volume directly at the victim’s authoritative DNS servers to exhaust their query capacity: the domain’s “phonebook” goes unreachable, and every service depending on it goes dark. DNS amplification instead sends small spoofed queries to open DNS resolvers, which reply with much larger records (often via an ANY query) to the victim’s spoofed address.
The 2026 novelty is the explosion of CLDAP. This reflection vector, which abuses exposed LDAP-over-UDP endpoints on Active Directory domain controllers, surged +580 % quarter-over-quarter to become the third vector in Q2. Its popularity is protocol-level: CLDAP is connectionless (UDP, no handshake), so the attacker can spoof the source address, and the replies are tens to hundreds of times larger than the original query. A free amplifier, distributed across every Windows estate with UDP 389 exposed.
Who is targeted, and where attacks come from
The report draws a precise geography. On the target side, China ends the half-year on top with 22.4 % of HTTP DDoS requests in Q2, ahead of the United States (18.8 %). Turkey more than doubles its share to climb to third, in the run-up to the Ankara NATO summit. On the source side, Brazil overtakes the United States as the top origin country (14.9 % vs 13.4 %), driven by a Q2 in which it generated 21.4 % of attack traffic.
Two events frame the half-year. On February 28, 2026, Operation Epic Fury (Israeli-American strikes on Iran) triggered, within 72 hours, a wave of 149 hacktivist claims against 110 organizations in 16 countries, 47.8 % of them in the government sector — which jumped from 29th to 9th among targeted industries. And Cloudflare notes a possible decline in DDoS-for-hire, which it ties to Operation PowerOFF: 21 countries, more than 75,000 stresser users targeted, 53 domains seized, and four arrests.
What this changes for a network operator
Three practical consequences stand out. First, protection must be always on: with attacks lasting seconds, “on-demand” mitigation activated after detection is structurally too late. Second, you have to cover both layers — bandwidth and packet rate — because attackers alternate to hit wherever the defense is thinnest. Third, the hygiene of exposed endpoints becomes a first-class networking concern again: every open DNS resolver or domain controller reachable on UDP 389 is an amplifier others will use against you or your neighbors.
That last point is the most actionable. The rise of CLDAP and DNS amplification means part of the attackers’ firepower comes from your own misconfigured infrastructure. Auditing what listens on UDP 389 (the CLDAP/LDAP port), closing open recursive resolvers, and applying BCP 38 (source-address anti-spoofing) reduces both your exposure and the ecosystem’s.
The operational response, step by step
None of this is exotic; it is standard network hygiene that the report’s numbers make newly urgent. The first move is discovery: find what is actually exposed. Open recursive resolvers and domain controllers reachable from the internet are the ammunition this report is describing, and most operators do not know they have any. A quick sweep of your own address space for UDP 53 and UDP 389 is the fastest way to measure your contribution to the problem.
The second move is response limiting. For authoritative DNS, enable response rate limiting (RRL) and drop ANY queries, which are the amplification vector’s favorite request. For CLDAP, the fix is blunt but effective: do not expose UDP 389 to the internet, period. LDAP over UDP has no legitimate reason to cross a perimeter; the directory stays reachable on TCP 636 (LDAPS) for anything that genuinely needs it. The third move is anti-spoofing at the edge: BCP 38 ingress filtering, so your network cannot be used as the source of reflected traffic aimed at someone else.
The fourth move is the one most teams skip: test before you need it. An always-on mitigation platform is only “always on” if it is configured and exercised. Run a controlled load test against a staging target, confirm the mitigation kicks in without a human in the loop, and write down the escalation path for the attacks that still get through — the report’s own numbers say you will have seconds, not minutes, to react.
Verdict
The DDoS Threat Report H1 2026 reveals no new technique; it confirms a trend: the attack is becoming a massive, disposable object, fired in a few seconds, often amplified by services their owners forgot about. The defense is no longer a matter of reactivity but of architecture: always-on protection, dual-layer coverage, and cleaning up amplifiers.
The recommendation is conditional but clear: if your DDoS protection is an on-demand service activated after an alert, consider it already obsolete — the 35 seconds of a record assault leave no room for human intervention, and inline, automated mitigation is required. If you operate DNS resolvers or domain controllers, audit this week what listens on UDP 389 and your open resolvers: it is the fastest lever for taking power away from attackers. The numbers are here — the question is whether your architecture is too.