Report by Cloudflare
Cloudflare DDoS Threat Report H1 2026
Key Findings
DNS-based attacks accounted for 34.3% of network-layer attacks in the first half of 2026.
CLDAP Floods surged 580% quarter-over-quarter and became the #3 attack vector in Q2 2026.
April 2026 peaked at 6.46 trillion HTTP DDoS requests and 165 petabytes of volume.
96.62% of network-layer DDoS attacks remained under 500 Mbps in the first half of 2026.
90.60% of network-layer DDoS attacks ended in under 10 minutes in the first half of 2026.
China absorbed 22.4% of all HTTP DDoS requests globally in Q2 2026, while the United States accounted for 18.8%.
Turkey more than doubled its share of global DDoS attack traffic to climb into the #3 most-attacked position by Q2 2026.
Brazil was the top DDoS source country in H1 2026 at 14.9%, overtaking the United States at 13.4%, and Brazil accounted for 21.4% of mitigated DDoS request traffic in Q2.
DNS Floods increased from 25.7% to 40.0% of network-layer attacks quarter-over-quarter.