DDoS Attack Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: August 14, 2026 | License: CC BY 4.0
Cloudflare mitigated 23.2 million network-layer DDoS attacks in the first six months of 2026 — about 5,343 every hour. The number that actually moved is smaller. Attacks crossing 1 Tbps went from 130 in Q1 to 805 in Q2, a 519% quarter-over-quarter jump. The ceiling rose. The floor did not.
Quick Answer
DDoS activity in 2026 is defined by a widening gap between typical attacks and extreme ones. Cloudflare’s H1 2026 DDoS Threat Report, published August 11, 2026, records 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests between January and June. Of those, 935 exceeded 1 Tbps. According to Axis Intelligence Research, that means roughly 1 network-layer DDoS attack in 24,813 was hyper-volumetric during H1 2026 — but in Q2 alone the ratio tightened to 1 in 16,360, a 4.72× concentration increase over Q1. The Axis DDoS Escalation Pressure Index (DEPI™) reads 84.2 for Q2 2026, up from a baseline 51.6 in Q1.
Key Findings
- Cloudflare mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion HTTP DDoS requests in the first half of 2026, equal to approximately 128,000 network-layer attacks per day.
- Network-layer DDoS attacks exceeding 1 Tbps rose from 130 in Q1 2026 to 805 in Q2 2026 — a 519% quarter-over-quarter increase, per Cloudflare’s H1 2026 DDoS Threat Report.
- According to Axis Intelligence Research, the Axis DDoS Escalation Pressure Index (DEPI™) rose from a baseline 51.6 in Q1 2026 to 84.2 in Q2 2026, with 62% of that 32.6-point move attributable to the volumetric-ceiling component alone.
- NETSCOUT ATLAS telemetry recorded 8,088,463 DDoS attacks across 203 countries and territories during the second half of 2025, with EMEA absorbing 3,331,570 of them — 41.2% of the global total.
- The FBI’s Internet Crime Complaint Center logged 715 botnet-category complaints in 2025 — the category under which IC3 records DDoS and TDoS activity — against $13,859,049 in reported losses, a reporting base four orders of magnitude below network-operator telemetry.
How Many DDoS Attacks Happen Per Day in 2026?
Roughly 128,000, measured on one network.
That qualifier matters more than the number. Cloudflare’s 23.2 million figure covers attacks its own systems mitigated across a network the company states protects more than 20% of the web. It is not a global census. No global census exists, and any DDoS statistics page presenting one is adding a denominator that nobody measured.
What the Cloudflare telemetry supports is a rate: 5,343 network-layer attacks per hour across the January–June 2026 window. April was the peak month, hitting 6.46 trillion requests and 165 petabytes of attack traffic before both metrics declined.
| Metric | H1 2026 value | Source |
|---|---|---|
| Network-layer DDoS attacks mitigated | 23,200,000 | Cloudflare, H1 2026 DDoS Threat Report |
| HTTP DDoS requests mitigated | 29,640,000,000,000 | Cloudflare, H1 2026 DDoS Threat Report |
| Network-layer attacks per hour | 5,343 | Cloudflare, H1 2026 DDoS Threat Report |
| Network-layer attacks per day (Axis-calculated) | 128,177 | Axis Intelligence Research, from Cloudflare H1 total ÷ 181 days |
| Peak month by request volume | April 2026 (6.46 trillion) | Cloudflare, H1 2026 DDoS Threat Report |
| Peak month by traffic volume | April 2026 (165 PB) | Cloudflare, H1 2026 DDoS Threat Report |
The quarterly split is where the story lives: 10.04 million network-layer attacks in Q1, 13.17 million in Q2. Frequency rose 31.2% quarter over quarter. Severity rose considerably faster.
Marcus Chen: Every year someone writes that DDoS is a solved problem because the median attack is trivial. The median attack is trivial — and that has been true since roughly 2016. The interesting question is never the median. It is what happens at the tail, because the tail is what takes an unprotected data centre off the internet, and the tail is the only part of this distribution that has changed shape in 2026.
How Big Is the Largest DDoS Attack Ever Recorded?
Cloudflare’s 2026 Threat Report, published March 3, 2026, documents a record attack of 31.4 Tbps and describes that figure as the new baseline for hyper-volumetric activity. Independently, NETSCOUT’s DDoS Threat Intelligence Report Issue 16 recorded demonstration attacks reaching 30 Tbps and 4 Gpps during the second half of 2025, attributing them primarily to the Aisuru IoT botnet and related TurboMirai variants.
Two network operators with different vantage points, different customer bases, and different measurement methodologies landed within 5% of each other on peak capacity. That convergence is the strongest evidence in this dataset that the ~30 Tbps ceiling is real rather than a marketing artefact.
Hyper-volumetric attacks by quarter
Cloudflare defines hyper-volumetric as exceeding 1 Tbps, 1 Bpps, or 1 Mrps.
| Quarter | Attacks >1 Tbps | Network-layer attacks | Hyper-volumetric density (Axis-calculated) | Source |
|---|---|---|---|---|
| Q1 2026 | 130 | 10,040,000 | 0.001295% — 1 in 77,231 | Cloudflare / Axis Intelligence Research |
| Q2 2026 | 805 | 13,170,000 | 0.006112% — 1 in 16,360 | Cloudflare / Axis Intelligence Research |
| H1 2026 | 935 | 23,200,000 | 0.004030% — 1 in 24,813 | Cloudflare / Axis Intelligence Research |
The density figure nobody else publishes
Reporting “805 terabit-scale attacks” without a denominator tells a reader nothing about whether their own exposure changed. Axis Intelligence Research calculates hyper-volumetric density as attacks exceeding 1 Tbps ÷ total network-layer attacks in the same period, on the same network, in the same report — the only combination that makes the ratio meaningful.
- Q1 2026: 130 ÷ 10,040,000 = 0.001295%
- Q2 2026: 805 ÷ 13,170,000 = 0.006112%
- Change: 4.72× increase in concentration
Frequency grew 31% quarter over quarter. Density grew 372%. An organisation whose defensive posture was calibrated to Q1 exposure is, on this measure, facing an attack population nearly five times more likely to contain a terabit-scale event — while total attack volume looks almost flat by comparison.
What Is the Axis DDoS Escalation Pressure Index (DEPI™)?
DEPI™ — the DDoS Escalation Pressure Index — is a quarterly 0–100 composite measuring how much pressure the DDoS threat environment places on automated defences. It exists because the headline counts move in opposite directions from the characteristics that determine whether a defence holds, and no single published figure captures both at once.
DEPI is built entirely from Cloudflare network telemetry so that all four components share one measurement methodology, one network, and one reporting cadence. Cross-operator blending was rejected during construction: NETSCOUT ATLAS and Cloudflare measure different populations, and averaging them would produce a number that describes neither.
DEPI components and weights
| # | Component | What it measures | Reference ceiling | Weight |
|---|---|---|---|---|
| C1 | Volumetric ceiling pressure | Attacks >1 Tbps in the quarter | 1,000 attacks | 0.30 |
| C2 | Attack frequency pressure | Network-layer attacks in the quarter | 15,000,000 attacks | 0.25 |
| C3 | DNS-flood concentration | DNS Flood share of network-layer attacks | 50.0% | 0.25 |
| C4 | Response-window compression | Share of attacks ending under 10 minutes | 100% (direct scale) | 0.20 |
Each component is normalised as min(value ÷ ceiling, 1) × 100, then weighted and summed. Reference ceilings are fixed at index construction and are held constant across future readings so that quarter-to-quarter movement reflects the threat environment, not a moving yardstick.
DEPI = 0.30·C1 + 0.25·C2 + 0.25·C3 + 0.20·C4
DEPI readings
| Quarter | C1 | C2 | C3 | C4 | DEPI | Source |
|---|---|---|---|---|---|---|
| Q1 2026 (baseline) | 13.00 | 66.93 | 51.40 | 90.60 | 51.6 | Axis Intelligence Research, from Cloudflare H1 2026 data |
| Q2 2026 | 80.50 | 87.80 | 80.00 | 90.60 | 84.2 | Axis Intelligence Research, from Cloudflare H1 2026 data |
Worked calculation for Q2 2026: 0.30×80.50 + 0.25×87.80 + 0.25×80.00 + 0.20×90.60 = 24.150 + 21.950 + 20.000 + 18.120 = 84.22
According to Axis Intelligence Research, DEPI™ rose 32.6 points between Q1 and Q2 2026, and 62% of that movement came from the volumetric-ceiling component alone. The index is not a danger score. What it is saying is that the specific characteristic which defeats manually-operated mitigation — extreme size arriving inside a short window — moved further in one quarter than the other three components combined.
Scope of the index. DEPI reads one network’s telemetry and inherits that network’s customer composition; a shift in Cloudflare’s mix would move C2 without any change in the underlying threat. C4 is published by Cloudflare only as a half-year figure, so it is held constant across both quarters and contributes no quarter-over-quarter movement — a deliberately conservative choice that understates rather than inflates the Q2 reading. Reference ceilings are editorial judgement anchored to observed 2026 maxima, not statistical optimisation. DEPI is recomputed each quarter on publication of the Cloudflare DDoS Threat Report; component definitions and weights will not change without a re-baselining note, and historical readings are never silently rewritten.
How Long Does the Average DDoS Attack Last?
Under ten minutes, for nine attacks in ten.
Cloudflare records that 90.60% of network-layer DDoS attacks in H1 2026 ended within ten minutes, and 96.62% stayed under 500 Mbps. Attacks running longer than three hours rose from 0.387% in Q1 to 0.828% in Q2 — a doubling, from a very small base.
| Attack characteristic | H1 2026 share | Source |
|---|---|---|
| Ending in under 10 minutes | 90.60% | Cloudflare, H1 2026 DDoS Threat Report |
| Under 500 Mbps | 96.62% | Cloudflare, H1 2026 DDoS Threat Report |
| Lasting over 3 hours (Q1) | 0.387% | Cloudflare, H1 2026 DDoS Threat Report |
| Lasting over 3 hours (Q2) | 0.828% | Cloudflare, H1 2026 DDoS Threat Report |
Cloudflare reports observing record-scale attacks that ran 35 seconds end to end.
Marcus Chen: Thirty-five seconds is shorter than the time it takes a tier-one analyst to acknowledge a page, open the console, and identify the vector. That is the whole argument for always-on mitigation, and it does not require anybody to describe the threat landscape as evolving. The aftershocks outlast the attack anyway — routing instability, TCP retransmissions, application timeouts — so a thirty-five-second flood can produce hours of degraded service. Attack duration and outage duration are different measurements, and conflating them is the most common error in this category.
Provisioning decisions here sit alongside broader architecture spend — our zero trust adoption and breach-cost data covers the control-side of the same budget conversation.
Note also that “small” is doing heavy lifting in the 96.62% figure. Cloudflare’s own framing is worth keeping: 100 Mbps is enough to overwhelm a single unprotected server, and 100 Gbps will take most unprotected data centres offline. The sub-500 Mbps majority is only harmless relative to a terabit.
Which DDoS Attack Vectors Are Most Common in 2026?
The centre of gravity moved from botnet floods to reflection and amplification.
DNS became the dominant network-layer vector
DNS-based attacks — DNS Flood plus DNS Amplification — accounted for 34.3% of all network-layer activity in H1 2026. Within that, DNS Floods climbed from 25.7% of network-layer attacks in Q1 to 40.0% in Q2.
The two mechanisms are distinct. A DNS Flood points raw botnet request volume at a victim’s authoritative nameservers until query capacity is exhausted; every service depending on that domain goes dark. DNS Amplification sends small spoofed queries to open resolvers, which return much larger records to the spoofed victim address.
CLDAP amplification grew 580%
CLDAP Flood — abusing exposed Active Directory LDAP-over-UDP endpoints on port 389 — grew 580% quarter over quarter to become the third-ranked vector in Q2 2026. Because CLDAP is connectionless and runs over UDP, there is no handshake to defeat source-address spoofing, and responses return tens to hundreds of times larger than the query.
| Vector | Share / change | Period | Source |
|---|---|---|---|
| DNS-based (Flood + Amplification) | 34.3% of network-layer attacks | H1 2026 | Cloudflare, H1 2026 DDoS Threat Report |
| DNS Flood | 25.7% → 40.0% of network-layer attacks | Q1 → Q2 2026 | Cloudflare, H1 2026 DDoS Threat Report |
| CLDAP Flood | +580% QoQ, #3 vector in Q2 | Q1 → Q2 2026 | Cloudflare, H1 2026 DDoS Threat Report |
Multivector complexity is now the norm
NETSCOUT’s ATLAS data for the second half of 2025 shows attack complexity has settled into a stable pattern: just over half of all attacks combine more than one vector.
| Vectors per attack | Share of attacks (2H 2025) | Source |
|---|---|---|
| 1 vector | 48.76% | NETSCOUT, DDoS Threat Intelligence Report Issue 16 |
| 2–5 vectors | 42.06% | NETSCOUT, DDoS Threat Intelligence Report Issue 16 |
| 6–10 vectors | 8.08% | NETSCOUT, DDoS Threat Intelligence Report Issue 16 |
| 11–15 vectors | 0.80% | NETSCOUT, DDoS Threat Intelligence Report Issue 16 |
| 16–20 vectors | 0.28% | NETSCOUT, DDoS Threat Intelligence Report Issue 16 |
| 21+ vectors | 0.04% | NETSCOUT, DDoS Threat Intelligence Report Issue 16 |
Published shares sum to 100.02% owing to rounding in the source. Axis Intelligence Research calculates the multivector share at 51.24% — 100% minus the single-vector 48.76%, the cleanest arithmetic available given the rounding. Moderate complexity, not extreme complexity, is what defenders actually face: attacks using more than ten vectors account for 1.12% of the population.
NETSCOUT also recorded at least 38 significant attack events against DNS root servers during 2025, the largest a 21 Gbps flood against the A root server on August 17, 2025. The root system maintained availability throughout — a result the report attributes to anycast deployment and capacity provisioning rather than to any decline in attacker interest.
Which Industries and Countries Are Most Targeted by DDoS Attacks?
Media, Production & Publishing took the top spot in both quarters
Media, Production & Publishing absorbed 14.2% of all mitigated HTTP DDoS requests in H1 2026 — nearly four times the share of the second-placed industry. Cloudflare links the concentration to sustained attention on Iran, Ukraine, and the World Cup.
The Government sector produced the largest single vertical move of 2026 so far, climbing from #29 in Q1 to #9 in Q2. Following the February 28, 2026 strikes on Iranian leadership and infrastructure, security researchers recorded 149 hacktivist DDoS claims against 110 distinct organisations across 16 countries within 72 hours, with 47.8% of targeted organisations globally belonging to the government sector.
Target and source countries
| Rank | Most-attacked location (Q2 2026 share) | Top DDoS source country (H1 2026 share) |
|---|---|---|
| 1 | China — 22.4% | Brazil — 14.9% |
| 2 | United States — 18.8% | United States — 13.4% |
| 3 | Turkey | Indonesia |
Source: Cloudflare, H1 2026 DDoS Threat Report.
Turkey more than doubled its share of global attack traffic to reach #3 by Q2, coinciding with the run-up to the 2026 Ankara NATO Summit. Brazil overtook the United States as the leading source country, driven by a Q2 surge in which Brazil originated 21.4% of all mitigated DDoS request traffic. Indonesia held #3 in both quarters, extending a multi-quarter run.
Regional attack distribution
NETSCOUT’s regional breakdown for 2H 2025 uses a different measurement basis — global ATLAS telemetry rather than one provider’s mitigated traffic — and is presented separately for that reason.
| Region | Attacks (2H 2025) | Share of global total (Axis-calculated) | Source |
|---|---|---|---|
| EMEA | 3,331,570 | 41.2% | NETSCOUT, Issue 16 |
| APAC | 1,904,602 | 23.5% | NETSCOUT, Issue 16 |
| North America | 1,272,625 | 15.7% | NETSCOUT, Issue 16 |
| Latin America | 1,014,148 | 12.5% | NETSCOUT, Issue 16 |
| Global total | 8,088,463 | 100% | NETSCOUT, Issue 16 |
Axis Intelligence Research notes that the four named regions sum to 7,522,945 — leaving 565,518 attacks, or 7.0% of the global total, outside the published regional breakdown. NETSCOUT does not attribute that remainder in Issue 16. Any regional percentage derived from this dataset carries that 7% unallocated share, and readers reproducing these shares should carry it too.
How Much DDoS Crime Actually Gets Reported to Authorities?
Almost none of it, relative to what networks observe.
The FBI’s 2025 Internet Crime Report records 715 complaints in the botnet category during 2025, with $13,859,049 in reported losses. IC3 defines a botnet as computers controlled remotely for illegal purposes including distributed denial-of-service or telephony denial-of-service attacks — making this the closest thing the U.S. federal system publishes to a DDoS victim-reporting count.
| Year | IC3 botnet-category complaints | Reported losses | Source |
|---|---|---|---|
| 2023 | 540 | $22,422,708 | FBI IC3, 2025 Internet Crime Report |
| 2024 | 587 | $8,860,202 | FBI IC3, 2025 Internet Crime Report |
| 2025 | 715 | $13,859,049 | FBI IC3, 2025 Internet Crime Report |
For context on the reporting system itself: IC3 received 1,008,597 total complaints in 2025 against $20.877 billion in reported losses, the first year total losses passed $20 billion.
Axis Intelligence Research will not publish a ratio between these two datasets, and the reason is worth stating. The 715 figure counts voluntary U.S. victim complaints under a category that also captures non-DDoS botnet activity. The 23.2 million figure counts globally mitigated attack events on one commercial network, most of which never reached a victim in a form worth reporting. Dividing one by the other produces a headline-friendly “under-reporting multiple” that would be arithmetically valid and analytically meaningless.
What the two datasets do support, side by side, is a direction: IC3 botnet complaints rose 21.8% from 2024 to 2025, while reported losses in that category remain under $14 million — a figure smaller than the annual security budget of a single mid-sized bank. DDoS is measured almost entirely by the companies selling mitigation for it. That is not an accusation; it is a structural feature of the evidence base, and it belongs in any honest reading of DDoS attack statistics.
Is Law Enforcement Reducing DDoS-for-Hire Activity?
There is one natural experiment in the 2026 data.
On April 13, 2026, 21 countries ran a coordinated action week under Operation PowerOFF, targeting over 75,000 criminal users of DDoS-for-hire services. Europol reports the week produced four arrests, 25 search warrants, the takedown of 53 domains, and more than 75,000 warning emails and letters to identified users.
| Operation PowerOFF, April 13 2026 | Result | Source |
|---|---|---|
| Participating countries | 21 | Europol |
| Users warned | 75,000+ | Europol |
| Domains taken down | 53 | Europol |
| Search warrants issued | 25 | Europol |
| Arrests | 4 | Europol |
Cloudflare’s own reporting places April 2026 as the peak month for both request volume and traffic volume, with both declining afterward — and explicitly floats Operation PowerOFF as a possible reflection of that decline.
Marcus Chen: Cloudflare said “a possible reflection,” and that hedge is the correct one. April was the peak; the takedown was mid-April; volumes fell after. That is a correlation with a plausible mechanism, and it is not a causal finding — Q2 still produced 13.17 million network-layer attacks and 805 terabit-scale events, which is not what a suppressed ecosystem looks like. The honest read is that booter takedowns appear to move the commodity end of the market while the high-capacity botnet end keeps setting records. Those are two different supply chains, and disrupting one does not touch the other.
NETSCOUT’s Issue 16 supports that split. Despite Operation Eastwood and multiple platform dismantlings, the hacktivist collective NoName057(16) alone claimed more than 200 attacks in July 2025, out of roughly 700 claimed attacks across all tracked actors that month. For the wider picture on where that capability comes from, see our data on AI adoption across enterprise workloads. NETSCOUT also documents conversational AI being integrated directly into stresser platforms, letting operators specify outcomes in plain language rather than configuring ports and packet sizes.
How much of a security budget reaches availability protection rather than detection is a separate question — one our cybersecurity spending statistics address directly. For defenders, the practical guidance has not changed much. CISA, the FBI, and MS-ISAC’s joint guide classifies DDoS into volumetric, protocol, and application techniques, and its core recommendation — that mitigation capacity must be provisioned before the attack, not procured during it — reads more urgently against a 35-second attack than it did when written.
Methodology
Collection. Every figure in this report was retrieved from a primary source document during production on August 12–13, 2026, and logged with its URL and retrieval date in the accompanying CSV. Sources are limited to network operators publishing their own telemetry (Cloudflare, NETSCOUT) and government agencies publishing their own case data (FBI IC3, Europol, CISA). No secondary aggregator, vendor blog summary, or market-research estimate is cited as the source of any figure here.
Provider telemetry is provider-scoped. Cloudflare figures describe attacks mitigated on the Cloudflare network. NETSCOUT figures describe attacks observed via ATLAS across 203 countries, 376 industry verticals, and 12,698 autonomous system numbers. Neither is a global count, and this report does not present either as one.
Axis-calculated figures. Four figures in this report are computed by Axis Intelligence Research rather than reported by a source: hyper-volumetric density (attacks >1 Tbps ÷ network-layer attacks, same network, same period); attacks per day (H1 total ÷ 181 days); NETSCOUT regional shares and the 565,518 unallocated remainder; and the DEPI™ readings. Each carries its formula inline and a method_note in the CSV.
Cross-source restraint. Cloudflare and NETSCOUT measure different populations by different methods. Where their figures cover the same concept, they are presented side by side with their bases stated, never averaged or merged. The same rule governs the treatment of IC3 complaint counts against operator telemetry.
Full detail on how Axis Intelligence Research assembles and checks datasets is documented in our research methodology.
Verification. Every numeric token in this article was matched against a CSV row before publication. Arithmetic was verified in Python, and the DEPI™ calculation was independently recomputed longhand in a separate pass. All six external source URLs were fetched and confirmed live and confirmed to contain the claims attributed to them.
Scope. DDoS measurement has no independent auditor. The largest datasets are published by companies that sell DDoS mitigation, which creates a structural incentive that no amount of methodological care removes. This report addresses that by preferring figures that are internally checkable — ratios, shares, and quarter-over-quarter movements within a single provider’s own reporting — over absolute totals that cannot be validated externally.
About This Dataset
Title: DDoS Attack Statistics 2026 Publisher / Creator: Axis Intelligence Research
Co-author: Marcus Chen (Cybersecurity)
Temporal coverage: 2023–2026, with primary focus on January–June 2026
Spatial coverage: Global
Format: CSV, UTF-8, one observation per row, full provenance columns
License: CC BY 4.0
File: ddos-attack-statistics-2026.csv
Every number appearing in this article exists as a row in the CSV, at the same value and the same as-of date, with its source organisation, source document, source URL, retrieval date, primary-source flag, and — for Axis-calculated rows — the formula used.
This dataset sits within the Axis Intelligence Research statistics catalogue.
How to Cite This Research
APA: Axis Intelligence Research. (2026). DDoS attack statistics 2026. Axis Intelligence. https://axis-intelligence.com/ddos-attack-statistics/
MLA: Axis Intelligence Research. “DDoS Attack Statistics 2026.” Axis Intelligence, 14 Aug. 2026, axis-intelligence.com/ddos-attack-statistics/.
Chicago: Axis Intelligence Research. “DDoS Attack Statistics 2026.” Axis Intelligence, August 14, 2026. https://axis-intelligence.com/ddos-attack-statistics/.
Citing DEPI™: Axis Intelligence Research, DDoS Escalation Pressure Index (DEPI™), Q2 2026 reading: 84.2, August 14, 2026, axis-intelligence.com/ddos-attack-statistics/.
DDoS Attack Statistics: Frequently Asked Questions
Does a 1 Tbps attack figure mean my origin needs 1 Tbps of capacity?
No. Hyper-volumetric traffic is absorbed upstream by a scrubbing network or anycast edge before it reaches your origin; your capacity requirement is set by what leaks through, not by the attack’s headline size. The number that should drive your provisioning is time-to-mitigate, because Cloudflare records 90.60% of H1 2026 attacks ending inside ten minutes — meaning a mitigation path that activates in fifteen has already missed the event.
Why did DNS Floods overtake other network-layer vectors in Q2 2026?
DNS Floods rose from 25.7% to 40.0% of network-layer attacks between Q1 and Q2 2026. The vector targets authoritative nameservers directly rather than the application, so a successful flood removes name resolution for every service under that domain at once — a single exhaustion point with a very large blast radius. It also requires no reflector infrastructure, which makes it cheap for botnet operators with sufficient node count.
What exposure does CLDAP amplification actually represent on my network?
CLDAP Flood grew 580% quarter over quarter in 2026 by abusing domain controllers reachable from the internet on UDP port 389. The exposure is entirely on the reflector side: if your Active Directory infrastructure answers CLDAP queries from arbitrary sources, your servers are amplifying attacks against third parties and consuming your own egress doing it. The remediation is access control at the network edge, not DDoS mitigation.
Is the median DDoS attack size actually a useful planning figure?
Only as a floor. Cloudflare records 96.62% of H1 2026 network-layer attacks staying under 500 Mbps, but Cloudflare’s own framing is that 100 Mbps overwhelms a single unprotected server and 100 Gbps takes most unprotected data centres offline. Planning to the median leaves you sized for the attacks that were never going to hurt you.
Why do DDoS attack counts differ so much between vendors?
Because they count different populations. Cloudflare reported 23.2 million network-layer attacks in H1 2026 on its own network; NETSCOUT recorded 8,088,463 attacks in 2H 2025 via ATLAS telemetry spanning 203 countries and 12,698 ASNs. Different visibility, different detection thresholds, different definitions of what constitutes one attack event. Neither is wrong, and neither is a global total.
Does DDoS activity reliably spike around geopolitical events?
The 2026 data supports a strong association. Within 72 hours of the February 28, 2026 strikes on Iran, researchers recorded 149 hacktivist DDoS claims against 110 organisations in 16 countries, and the Government vertical moved from #29 to #9 by share of mitigated HTTP DDoS requests. Turkey’s rise to the #3 most-attacked location coincided with the Ankara NATO Summit buildup. Treat major scheduled events in your operating regions as capacity-planning inputs.
Do booter takedowns reduce the attacks my organisation sees?
Partially, and unevenly. Operation PowerOFF warned over 75,000 users and removed 53 domains in April 2026, and Cloudflare observed request and traffic volumes declining after an April peak — which the company describes as a possible reflection of the operation. But Q2 still produced 805 attacks above 1 Tbps. Enforcement pressure appears to reach the commodity stresser market more than the high-capacity IoT botnets responsible for record-scale events.
What does the DEPI™ reading tell a security team that raw attack counts do not?
DEPI™ combines size, frequency, vector concentration, and attack duration into one quarterly figure, so it moves when the character of the threat changes rather than only its volume. Q2 2026’s reading of 84.2 against a 51.6 baseline was driven 62% by the volumetric-ceiling component — meaning a team reading only the 31.2% rise in attack counts would have missed almost all of the change that matters for mitigation architecture.
Is DDoS under-reported to law enforcement?
The reporting base is very small relative to observed activity: FBI IC3 logged 715 botnet-category complaints in 2025 against $13,859,049 in losses, while network operators count attacks in the millions. Axis Intelligence Research does not publish a ratio between the two, because IC3 counts voluntary U.S. victim reports under a category broader than DDoS while operator telemetry counts globally mitigated events. The direction is clear; the multiple is not computable from these datasets.