DDoS Statistics

DNS-based attacks accounted for 34.3% of network-layer attacks in the first half of 2026.

CLDAP Floods surged 580% quarter-over-quarter and became the #3 attack vector in Q2 2026.

April 2026 peaked at 6.46 trillion HTTP DDoS requests and 165 petabytes of volume.

4% of reported cybercrime cases in Africa in 2025 involved DDoS attacks.

5% of Nordic CISOs cited DDoS and opportunistic probing as their primary concern.

Peak DDoS attack sizes increased by 262% year over year, with terabit-scale attacks occurring in seconds.

More than 90% of DDoS attacks last less than 10 minutes.

DDoS campaigns now combine 50+ attack vectors and adapt in real time.

Botnets leveraged more than 500,000 compromised systems to power DDoS campaigns.

Distributed denial-of-service campaigns reached a peak of 31.4 Tbps.

DDoS attack volumes reached 12 Tbps in Q4, representing a sixfold increase.

Mexico, Brazil, and the United States accounted for 31%, 24%, and 20% of network-layer observed attack traffic, respectively.

64% of application-layer DDoS attacks exceed 10 minutes.

Telecoms accounts for just 24% DDoS attacks in 2025, down from 42% in 2024.

Government’s share of total attacks increased from 5% to 12% year-over-year, with an average attack size of 5.5 Gbps.

Layer 7 DDoS attacks surged 104% over the past two years.

Manufacturing experienced an average attack size of 11.6 Gbps, the largest across all industries.

The number of documented DDoS attacks in the Link11 network rose by 75% in 2025, after a 137% increase the previous year.

Three DDoS attacks surpassed 1 Tbit/s in 2025.

The strongest DDoS attack measured 1.33 Tbit/s and exceeded 120 million packets per second.

75% of organizations are concerned about Distributed Denial-of-Service (DDoS) attacks targeting AI agents.

The technology sector represented 45% of all network-layer DDoS attacks, up from 8.77% in 2024.

North America accounted for 63.1% of all network-layer DDoS attacks globally, followed by the Middle East (16.1%) and Europe (13.7%).

In the second half of 2025 the average Radware customer experienced more than 25,351 network-layer DDoS attacks, averaging 139 attacks per day.

Colombia was the most targeted country by DDoS attacks with over 20 victims, followed by Venezuela and Brazil, in 2025.

60% of all reported cyber incidents in 2024 were Distributed Denial-of-Service (DDoS) attacks.

29% of leaders at financial services firms say they are unprepared to recover effectively from a Distributed Denial of Service attack.

20% of organizations cited denial-of-service attempts as the most common API security problem.

State-aligned operations, often driven by low-impact DDoS campaigns targeting EU Member States’ organisations’ websites, resulted in service disruption in only 2% of incidents.

Comcast Business detected 44,000 DDoS attacks, which often utilised short bursts and carpet-bombing techniques to overwhelm and test defenses

DDoS short bursts used as reconnaissance were also observed: 405 events in less than 5 minutes and 56 events in less than 10 seconds.

Within Public Administration, incidents were dominated by low-impact DDoS campaigns (94.8%).

The highest maximum number of packets transmitted per second recorded was 207,090,400 packets per second in the first half of 2025. 207 million packets per second can paralyze firewalls, servers, and entire networks within seconds.

The largest DDoS attack between January and July 2025 reached a maximum bandwidth of over 1.2 Tbit/s. This is double the largest attack in the first half of 2024, which was 694 Gbit/s.

In 2025, 98% of DDoS attacks routed malicious traffic through the US.

Hacktivist groups like NoName057(16) orchestrated hundreds of coordinated DDoS attacks each month.

There were multiple gigapacket-per-second (Gpps) DDoS attacks in the first half of 2025.

Bot-driven DDoS incidents peaked at 1,600 in March.

Sweden experienced 2.5 times more DDoS attacks year-on-year.

Increase in Largest Volumetric Assault (2024 vs. 2023): 63%.