935 DDoS Attacks Broke 1 Tbps — Cloudflare's Latest Threat Report Is Wild!

Hi, it's me, Shiichan! Today I've got a report from the Cloudflare Blog with a pretty ominous headline: attacks over 1 Tbps are surging. The numbers and the backstory were both a lot to take in, so let's dig in together!

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare Blog published the "DDoS Threat Report H1 2026," put together by Cloudforce One, Cloudflare's Threat Intelligence organization. It's the 25th report in the series, and the first-ever half-year edition. Instead of separate Q1 and Q2 reports like before, this one bundles January through June 2026 into a single volume. It's an analysis of DDoS (Distributed Denial of Service) attack trends, based on data Cloudflare observed across its entire network.

Why it matters

According to the report, DDoS attack trends are closely tied to geopolitics. What's happening in the world right now, the situations in Iran and Ukraine, big international events like the World Cup, shows up directly in who attackers choose to target. And this time, the sheer scale of the attacks has jumped too, so this is more than just a routine periodic report. It's worth a read whether you're on a security team or just curious about what's happening behind the headlines.

What changes

The report itself isn't a new Cloudflare product, it's a data-sharing exercise, but it still matters for readers:

• If you work in media/publishing or government, you can see exactly where your industry sits on the "most targeted" ranking
• Knowing that reflection-and-amplification attacks like DNS and CLDAP floods are on the rise gives you a hint for reprioritizing your defenses
• Around major international events or geopolitical flashpoints, it's a signal to raise your DDoS alert level

Alongside the report, Cloudflare also offers hosting providers, cloud platforms, and ISPs a way to identify and act on the abusive IPs and accounts behind these attacks, built on Cloudflare's own vantage point into DDoS traffic.

Dive Deep

This report was packed with numbers, so here are the details that stood out to me most!

The overall volume

• In H1 2026 alone, Cloudflare mitigated 23.2 million network-layer DDoS attacks and blocked 29.64 trillion HTTP DDoS requests
• That works out to roughly 5,343 network-layer attacks per hour, or about 128,000 a day. No rest for the wicked, apparently.

The "1 Tbps club" is exploding

• Attacks that exceed 1 terabit per second (Tbps), 1 billion packets per second (Bpps), or 1 million requests per second (Mrps) are called "hyper-volumetric DDoS," and there were 935 of them in H1 2026
• Q2 alone saw 805 attacks over 1 Tbps, more than 6x Q1's count, a 519% quarter-over-quarter surge

The center of gravity is shifting

• The center of the attack landscape is moving from botnet-driven floods to reflection-and-amplification attacks abusing DNS and CLDAP
• DNS-based attacks made up 34.3% of all network-layer activity in H1, and DNS Floods alone climbed from 25.7% to 40.0% quarter-over-quarter
• CLDAP Floods (a reflection-and-amplification attack that abuses exposed Active Directory LDAP-over-UDP endpoints) surged 580% quarter-over-quarter, becoming the #3 vector in Q2 alone

Media is running away with the "most attacked" crown

• Media, Production & Publishing was the most-attacked industry in both quarters, at 14.2% of all mitigated HTTP DDoS requests, coinciding with heavy coverage of the wars in Iran and Ukraine and the World Cup

Attacks on government spiked hard

• The government sector jumped from #29 to #9 in the industry ranking between Q1 and Q2, the single largest sector move of 2026
• The likely trigger was "Operation Epic Fury": on February 28, 2026, Israel and the US launched a series of strikes against Iran's leadership and infrastructure. Within 72 hours, the DDoS landscape responded, outside security research recorded 149 hacktivist DDoS claims against 110 organizations across 16 countries, and about 47.8% of those targeted organizations were in government

Turkey rose to the #3 most-attacked country

• Turkey climbed to the #3 spot in Q2, coinciding with the buildup to the NATO Summit in Ankara in late June and July, right before the summit, Turkish security forces conducted sweeping raids, arresting at least 209 people

The scale of Cloudflare's own defenses

• Cloudflare runs automated detection and mitigation across a network spanning 330+ cities worldwide, backed by 500 Tbps of capacity. Autonomy, minimal human intervention, was called out as the key point

Wrap-up

• Cloudforce One, Cloudflare's threat intelligence organization, published the "DDoS Threat Report H1 2026," the 25th report in the series and the first half-year edition
• H1 2026 saw 23.2 million network-layer DDoS attacks and 29.64 trillion HTTP DDoS requests blocked, with 935 attacks over 1 Tbps, a 519% quarter-over-quarter surge
• Attack methods are shifting from botnet floods toward DNS- and CLDAP-based reflection and amplification
• Media stayed the most targeted industry, while government attacks spiked around "Operation Epic Fury," and Turkey climbed the country rankings around the NATO Summit
• Worth reading for security and infrastructure folks, and for anyone curious how geopolitics and cyberattacks connect!