Cloudflare says the first half of 2026 brought a sharp escalation in large DDoS attacks, with hyper-volumetric events above 1 Tbps rising 519% across its network and DNS-based floods becoming the largest network-layer attack category.
In its H1 2026 DDoS Threat Report, the company said it mitigated 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests from January through June. The most important number for hosting teams is not only the headline Tbps figure: Cloudflare counted 805 network-layer attacks above 1 Tbps in the second quarter alone, more than six times the prior quarter.
DNS remains the uncomfortable center of the story. Cloudflare said DNS Flood and DNS Amplification attacks made up 34.3% of network-layer attacks in H1. A direct DNS flood can overwhelm authoritative name servers; amplification attacks abuse open resolvers to turn small spoofed queries into much larger replies. Either path can take a domain’s “phonebook” offline before the web server, CDN origin, mail platform or control panel has technically failed.
The report also called out CLDAP reflection, which grew 580% quarter over quarter and became the No. 3 vector in Q2. That matters for providers because exposed UDP directory services can become unwilling reflectors in attacks against someone else’s infrastructure.
Why hosting operators should care
Cloudflare noted that most attacks are still short: 90.60% of network-layer attacks ended in under 10 minutes, and the largest attacks can be over in seconds. That leaves little time for a human-on-call workflow to detect, ticket, escalate and manually enable mitigation.
For site owners and managed hosting providers, the practical checklist is familiar but newly urgent: keep authoritative DNS behind resilient providers, avoid single-provider DNS where downtime is unacceptable, close or filter abusable UDP services, preconfigure DDoS protection rather than treating it as an emergency switch, and verify that monitoring distinguishes origin downtime from DNS or edge failure.
The report is vendor-produced, but it is useful because Cloudflare operates a major global edge network and sees attacks against a broad set of sites, APIs and networks. The numbers also align with what many operators have experienced operationally: outage windows are shrinking, but burst size is rising, which makes automation and DNS-layer resilience more important than manual response.