Link11

The number of documented DDoS attacks in the Link11 network rose by 75% in 2025, after a 137% increase the previous year.

Three DDoS attacks surpassed 1 Tbit/s in 2025.

The strongest DDoS attack measured 1.33 Tbit/s and exceeded 120 million packets per second.

The highest maximum number of packets transmitted per second recorded was 207,090,400 packets per second in the first half of 2025. 207 million packets per second can paralyze firewalls, servers, and entire networks within seconds.

The largest DDoS attack between January and July 2025 reached a maximum bandwidth of over 1.2 Tbit/s. This is double the largest attack in the first half of 2024, which was 694 Gbit/s.

In 2025, 98% of DDoS attacks routed malicious traffic through the US.

Active DDoS attacks were observed 88% of the time, equating to 322 days per year when systems in the Link11 network are targeted.

The longest recorded DDoS attack lasted 12,388 minutes (over eight days) in the Link11 network.

On average, 2.8 follow-up DDoS attacks occured after an initial incident, an 80% increase compared to the previous year.

A coordinated series of DDoS attacks totaled 509 terabytes of data in 2025.

There is greater than a 70% probability that an initial DDoS attack is followed by at least one additional attack.

The maximum DDoS attack duration in June 2024 was only 73 minutes.

Attack success rates demonstrate that 40% to 50% of systems are still inadequately protected against politically motivated attack tactics.

Targeted sectors by DDoS attack in the first half of 2025: Defense (23% - an increase of 14%), retail & e-commerce (18% - an increase of 8%), logistics & transport (15% - an increase of 9%), public sector (11%), education (9%), finance (6%), healthcare (5%), telco (5%), technology, IT, Internet (4%), and other (4%).

Backbone DDoS attacks (targeting Internet service provider or data center infrastructure) increased by 143% compared to the first half of 2024.

One observed Layer 7 DDoS attack used around 20,000 legitimate HTTP requests per minute to disrupt sensitive areas. This is compared to 200 million packets per second for brute force attacks, indicating that precision can be more dangerous if unnoticed.

Targeted sectors by DDoS attacks in the first half of 2024: Finance (17%), public Sector (11%), retail & e-Commerce (10%), defense (9%), telco (8%), healthcare (7%), education (6%), media (6%), food (6%), energy (6%), logistics & transport (6%), other (10%).

The longest documented DDoS attack in the first half of 2025 lasted 12,388 minutes (8 days and 14 hours).

In 2025, 31% of DDoS attacks routed malicious traffic through Germany.

Targeted Sectors (Web Application and API Protection - WAAP) The analysis shows a shift in affected sectors between the first half of 2024 and the first half of 2025:

The longest DDoS attack in the first half of 2024 lasted 1,523 minutes (approximately 1 day and 1 hour).

The Link11 network recorded 225% more DDoS attacks in the first half of 2025 compared to the same period last year.

The cumulative DDoS attack volume rose from 110 TB in the first half of 2024 to 438 TB in the first half of 2025. 438 TB is equivalent to over 7 years of uninterrupted Netflix streaming in 4K. It is enough data for more than 1,700 years of uninterrupted audiobook playback.

Targeted sectors by DDoS attack in the first half of 2025: Defense (23% - an increase of 14%), retail & e-commerce (18% - an increase of 8%), logistics & transport (15% - an increase of 9%), public sector (11%), education (9%), finance (6%), healthcare (5%), telco (5%), technology, IT, Internet (4%), and other (4%).