Cloudflare Reports 519% Surge in 1 Tbps DDoS Attacks in Q2 2026

Significant Increase in Large-Scale DDoS Attacks

Cloudflare's H1 2026 DDoS Threat Report reveals a substantial rise in large-scale Distributed Denial of Service (DDoS) attacks. The company mitigated 935 network-layer DDoS attacks exceeding 1 Tbps in the first half of 2026. A notable surge of 519% quarter-over-quarter was observed in attacks over 1 Tbps between Q1 and Q2 2026.

Shift in Attack Vectors

The report indicates a change in the primary methods used for DDoS attacks. The center of gravity for attack vectors shifted from botnet floods to reflection and amplification techniques. DNS-based attacks constituted 34.3% of all network-layer activity during the first half of 2026.

Specifically, DNS Floods increased from 25.7% to 40.0% of network-layer attacks quarter-over-quarter. CLDAP Floods also saw a significant rise, surging 580% quarter-over-quarter to become the third most common vector in Q2.

Context and Data Collection

This analysis is the 25th edition of Cloudflare's DDoS Threat Report and the first half-year edition, combining data from January through June 2026. The report was produced by Cloudforce One, Cloudflare’s Threat Intelligence organization, utilizing data from the Cloudflare network. Cloudflare, a major web infrastructure and security firm, provides services including CDN, DNS, reverse-proxy, and DDoS protection, protecting approximately 20% of the web.

Overall Attack Volume

In the first half of 2026, Cloudflare mitigated a total of 23.2 million network-layer DDoS attacks and 29.64 trillion malicious HTTP requests. The report also notes that geopolitical and global events are influencing the DDoS threat landscape.