DDoS Statistics

The number of DDoS attacks on the Link11 network decreased by 42% in the first half of 2026 compared to the first half of 2025.

The highest measured DDoS bandwidth reached 2.3 Tbit/s, 85% higher than the previous peak of 1.2 Tbit/s in the first half of 2025.

DDoS packet rate peaked at 322 million packets per second, up 56% from 207 million packets per second a year earlier.

DNS-based attacks accounted for 34.3% of network-layer attacks in the first half of 2026.

CLDAP Floods surged 580% quarter-over-quarter and became the #3 attack vector in Q2 2026.

April 2026 peaked at 6.46 trillion HTTP DDoS requests and 165 petabytes of volume.

4% of reported cybercrime cases in Africa in 2025 involved DDoS attacks.

5% of Nordic CISOs cited DDoS and opportunistic probing as their primary concern.

Peak DDoS attack sizes increased by 262% year over year, with terabit-scale attacks occurring in seconds.

More than 90% of DDoS attacks last less than 10 minutes.

Six-second pulse DDoS attacks eliminate the window for reactive intervention.

Botnets leveraged more than 500,000 compromised systems to power DDoS campaigns.

Distributed denial-of-service campaigns reached a peak of 31.4 Tbps.

75% of network-layer DDoS attacks last less than one minute.

64% of application-layer DDoS attacks exceed 10 minutes.

DDoS attack volumes reached 12 Tbps in Q4, representing a sixfold increase.

89% of DDoS attacks now conclude in under 10 minutes.

Telecoms accounts for just 24% DDoS attacks in 2025, down from 42% in 2024.

Government’s share of total attacks increased from 5% to 12% year-over-year, with an average attack size of 5.5 Gbps.

Layer 7 DDoS attacks surged 104% over the past two years.

The number of documented DDoS attacks in the Link11 network rose by 75% in 2025, after a 137% increase the previous year.

Three DDoS attacks surpassed 1 Tbit/s in 2025.

The strongest DDoS attack measured 1.33 Tbit/s and exceeded 120 million packets per second.

75% of organizations are concerned about Distributed Denial-of-Service (DDoS) attacks targeting AI agents.

Web DDoS attacks targeting OSI layer 7 increased by 101.4% compared to 2024.

The technology sector represented 45% of all network-layer DDoS attacks, up from 8.77% in 2024.

North America accounted for 63.1% of all network-layer DDoS attacks globally, followed by the Middle East (16.1%) and Europe (13.7%).

Colombia was the most targeted country by DDoS attacks with over 20 victims, followed by Venezuela and Brazil, in 2025.

60% of all reported cyber incidents in 2024 were Distributed Denial-of-Service (DDoS) attacks.

29% of leaders at financial services firms say they are unprepared to recover effectively from a Distributed Denial of Service attack.

20% of organizations cited denial-of-service attempts as the most common API security problem.

Within Public Administration, incidents were dominated by low-impact DDoS campaigns (94.8%).

State-aligned operations, often driven by low-impact DDoS campaigns targeting EU Member States’ organisations’ websites, resulted in service disruption in only 2% of incidents.

Comcast Business detected 44,000 DDoS attacks, which often utilised short bursts and carpet-bombing techniques to overwhelm and test defenses

DDoS short bursts used as reconnaissance were also observed: 405 events in less than 5 minutes and 56 events in less than 10 seconds.

Targeted sectors by DDoS attacks in the first half of 2024: Finance (17%), public Sector (11%), retail & e-Commerce (10%), defense (9%), telco (8%), healthcare (7%), education (6%), media (6%), food (6%), energy (6%), logistics & transport (6%), other (10%).

The maximum DDoS attack duration in June 2024 was only 73 minutes.

The Link11 network recorded 225% more DDoS attacks in the first half of 2025 compared to the same period last year.

NETSCOUT monitored more than 8 million DDoS attacks globally in the first half of 2025.

Hacktivist groups like NoName057(16) orchestrated hundreds of coordinated DDoS attacks each month.