--- title: "Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave" url: https://daily.dev/posts/cloudflare-ddos-threat-report-h1-2026-1-tbps-attacks-soar-as-dns-floods-and-geopolitical-tensions-d-dyede91gy source_url: https://blog.cloudflare.com/ddos-threat-report-2026-h1 type: article source: "Cloudflare" published: 2026-08-11T13:16:45.794Z updated: 2026-08-11T15:34:33.253Z tags: ["security", "cyber", "cloudflare"] reading_time: 8 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave **[Cloudflare](https://daily.dev/sources/cloudflare)** · 8 min read · 0 upvotes · 0 comments ## Summary Cloudflare's 25th DDoS Threat Report covers H1 2026, combining Q1 and Q2 data. Key findings include 935 network-layer attacks exceeding 1 Tbps (a 519% QoQ surge in Q2), with DNS-based attacks accounting for 34.3% of all network-layer activity. CLDAP reflection attacks surged 580% QoQ to become the #3 vector. Geopolitical events heavily shaped the threat landscape: Operation Epic Fury drove the Government sector from #29 to #9 most-attacked, Media/Publishing remained #1 most-attacked industry at 14.2% of mitigated HTTP DDoS requests, and Turkey jumped to #3 most-attacked country ahead of the NATO Summit. Brazil overtook the US as the top DDoS source country. Cloudflare mitigated 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests in H1, averaging 5,343 attacks per hour. Despite hyper-volumetric growth, 96.62% of attacks stayed under 500 Mbps and 90.60% ended within 10 minutes, underscoring the need for automated, always-on protection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many DDoS attacks exceeding 1 Tbps did Cloudflare mitigate in H1 2026? Cloudflare mitigated 935 network-layer DDoS attacks exceeding 1 Tbps in H1 2026. Of these, 805 occurred in Q2 alone, representing a 519% quarter-over-quarter surge. The overall H1 total averaged roughly 5,343 network-layer DDoS attacks per hour, with April 2026 being the peak month at 6.46 trillion requests and 165 petabytes of volume. _Teams tracking hyper-volumetric DDoS trends find the latest threat data on daily.dev as reports drop._ ### What is a CLDAP flood attack and why did it surge in 2026? A CLDAP flood is a reflection and amplification DDoS vector that abuses exposed Active Directory LDAP-over-UDP endpoints on port 389. Because CLDAP uses UDP with no handshake, attackers spoof the victim's IP and send small queries to public domain controllers, which reply with responses tens to hundreds of times larger. CLDAP attacks surged 580% quarter-over-quarter in Q2 2026, becoming the #3 DDoS vector. _Security engineers defending against amplification vectors like CLDAP track emerging attack patterns on daily.dev._ ### Which industries and countries were most targeted by DDoS attacks in H1 2026? Media, Production & Publishing was the most-attacked industry in both Q1 and Q2, absorbing 14.2% of all mitigated HTTP DDoS requests — nearly four times the runner-up — driven by coverage of Iran, Ukraine, and the World Cup. China was the most-attacked country in H1, followed by the US at 18.8% and Turkey at #3. The Government sector made the largest single jump, rising from #29 to #9 following Operation Epic Fury. _Infrastructure teams monitoring geopolitically driven DDoS targeting stay current on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/cloudflare-ddos-threat-report-h1-2026-1-tbps-attacks-soar-as-dns-floods-and-geopolitical-tensions-d-dyede91gy)