The figure was more than six times the 130 terabit-scale attacks recorded during the first quarter. It brought the total number of attacks exceeding 1 Tbps during the first half of the year to 935, illustrating how traffic volumes once regarded as exceptional are becoming a more frequent challenge for network operators.
Overall network-layer DDoS attacks also climbed substantially. Cloudflare mitigated 13.17 million such attacks during the second quarter, compared with 10.04 million during the first three months of the year. Across the first half, the total reached 23.2 million, equivalent to about 128,000 attacks a day or more than 5,300 every hour.
The increase was not confined to attacks above the 1 Tbps threshold. Attacks generating between 500 gigabits per second and 1 Tbps jumped 143% quarter on quarter. Those producing between 100 Gbps and 500 Gbps rose 105%, showing that higher-volume activity expanded across several bandwidth categories.
Application-layer attacks were also extensive. Cloudflare processed about 29.64 trillion malicious HTTP requests during the first half of 2026. The second quarter alone accounted for 16.89 trillion HTTP DDoS requests, an increase of 32.4% from the previous quarter.
Despite the surge at the upper end, most network-layer attacks remained relatively small. About 96.6% transmitted less than 50 megabits per second, while roughly nine in 10 lasted no longer than 10 minutes. The contrast highlights a threat environment dominated numerically by short attacks but increasingly punctuated by exceptionally powerful traffic floods.
Long-duration activity also increased. More than 108,000 network-layer attacks lasting over three hours were observed during the second quarter, compared with fewer than 39,000 during the first quarter. Such attacks can impose heavier operational costs because infrastructure and mitigation systems must remain under sustained pressure.
DNS-related techniques emerged as a major component of the threat landscape. DNS floods and DNS amplification collectively accounted for about a third of network-layer activity during the first half. DNS floods became particularly prominent during the second quarter, accounting for roughly 40% of network-layer attacks, compared with 26% in the first quarter.
A DNS flood overwhelms authoritative DNS infrastructure with large volumes of requests, potentially preventing legitimate users from resolving domain names. DNS amplification attacks instead exploit improperly configured servers by sending small requests that trigger much larger responses towards a targeted system.
Another amplification technique, CLDAP flooding, registered one of the steepest increases. Activity involving the Connectionless Lightweight Directory Access Protocol rose 882% quarter on quarter, making it one of the most widely observed network-layer attack vectors during the period. By contrast, SSDP and SNMP flooding declined sharply.
The rising scale follows an extraordinary escalation seen during 2025. Cloudflare disclosed that it had mitigated a 31.4 Tbps attack in December, generated by infrastructure associated with the Aisuru/Kimwolf botnet. That attack demonstrated how compromised routers, Internet-connected devices and servers can collectively deliver traffic volumes far beyond the capacity of conventional enterprise connections.
Attack patterns during 2026 were also influenced by international tensions and major public events. Government organisations moved sharply higher among targeted sectors during the second quarter, while media, production and publishing remained the largest category measured by mitigated HTTP DDoS requests during the first half.
Media organisations accounted for about 14% of HTTP DDoS requests across the six-month period, reflecting heightened targeting of websites handling large audiences and politically sensitive coverage. Government organisations climbed from 29th place among targeted sectors during the first quarter to ninth during the second.
China became the largest destination for mitigated HTTP DDoS traffic during the second quarter, accounting for around 22% of the global total, followed by the United States at 19%. Turkey moved into third place after its share of attack traffic more than doubled.
Brazil, meanwhile, emerged as the largest source of mitigated DDoS request traffic across the first half, followed by the United States and Indonesia. Source locations do not necessarily identify attackers, because DDoS campaigns commonly rely on compromised devices distributed across numerous countries.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
