How DDoS Attacks Work: What Cloudflare's 2026 Report Shows

A DDoS attack knocks a website offline by burying it in more traffic than it can handle. Thousands of hijacked devices send requests at once, so the site cannot serve real visitors. Cloudflare's 2026 report found 935 attacks above one terabit per second in the first half of the year.

That number sounds like a movie plot, yet the mechanics are plain. This explainer walks through how a distributed denial-of-service attack works, what the new Cloudflare figures say, and why a surprising share of attacks end in under ten minutes. It is for anyone who has seen a site go down and wondered what actually happened. Oddworldz covers how the internet works behind the screen, and this is one of its loudest corners.

What Is a DDoS Attack?

A distributed denial-of-service attack is an attempt to make a service unavailable by overwhelming it with traffic from many sources. The Cybersecurity and Infrastructure Security Agency (CISA) says the aim is that "legitimate users are unable to access information systems, devices, or other network resources." You can read its plain-language guide on understanding denial-of-service attacks.

The "distributed" part matters. One computer sending too many requests is easy to block. Thousands of computers sending them from different places is much harder. Attackers often use a botnet, a network of hijacked internet-connected devices such as cameras and routers.

A botnet grows quietly. Malware slips onto a poorly secured device, such as an old router or camera with a default password, and waits for instructions. The owner sees nothing wrong. The device simply joins an army it never agreed to serve in. Because the machines sit in ordinary homes and offices, blocking them one by one is slow work.

Think of a shop with one door. A few customers walk in and out. A DDoS attack sends ten thousand people to stand in the doorway at once. Nobody is stealing anything, but real customers cannot get through.

How Big Did DDoS Attacks Get in 2026?

They got very large. Cloudflare's report for January to June 2026 says the company mitigated 935 network-layer attacks above 1 Tbps, and 805 of those landed in the second quarter alone. That is a 519% jump from the first quarter, according to the Cloudflare DDoS Threat Report for the first half of 2026.

Overall, Cloudflare blocked 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests in the six months. That averages about 5,343 network attacks per hour. Most are small, though. About 96.6% of network-layer attacks stayed under 500 megabits per second.

Cloudflare calls an attack "hyper-volumetric" when it passes one terabit per second, one billion packets per second or one million requests per second. A terabit is a thousand gigabits. For scale, a home fiber plan of one gigabit is a thousand times smaller than the biggest of these floods.

Why Do Most DDoS Attacks End So Fast?

Most end fast because defenders learn to filter them quickly, and because short bursts are cheap and hard to trace. Cloudflare says 90.6% of network-layer attacks ended in under ten minutes. The record hyper-volumetric attack in the report lasted just 35 seconds.

That fact surprises people who picture days-long sieges. In practice, many attackers fire a short, sharp burst, test the defenses and move on. A site with automatic protection often recovers before anyone files a support ticket.

There is one caution. A short attack can still do damage if it hits an unprotected server or a service that restarts slowly. Short does not always mean harmless. It means the defenders had little time to react by hand.

This is why big providers automate their defenses. A person cannot read logs and write a rule in 35 seconds. Software can spot the surge, route the junk traffic to filters and let real visitors through. Most people never see any of it happen, which is the point of good protection.

How Does a DNS Flood or Amplification Attack Work?

A DNS flood sends a huge volume of lookup requests to a domain's name servers until they stop answering. DNS is the internet's phone book. It turns a name like example.com into the number a computer needs. If the phone book goes offline, the site disappears even though its own server is fine.

Cloudflare found DNS-based attacks made up 34.3% of network-layer attacks in the first half of 2026. DNS floods rose from 25.7% to 40.0% of network-layer attacks from the first to the second quarter. We covered a real DNS failure in how one bug knocked .de websites offline, and it shows how much depends on that one directory.

Amplification is a different trick. The attacker sends a tiny request to a server and fakes the return address, so the server's big reply goes to the victim instead. The reply can be tens or hundreds of times larger than the question. The attacker spends little and the victim absorbs a flood.

What Is the CLDAP Flood Cloudflare Flagged?

A CLDAP flood is an amplification attack that abuses exposed directory servers. Cloudflare reported that CLDAP floods grew 580% from the first quarter to the second and became the third most common vector. The attacker sends small spoofed queries to a Windows directory server, which replies with far more data than it received.

CLDAP runs over UDP, a connection style that skips the handshake. Without a handshake, the server cannot easily tell whether the sender's address is real. That makes faking the source simple, and it is the weakness the trick depends on.

The same weakness shows up elsewhere online. Faked sender details are also why phone numbers can lie, as we explained in how caller ID spoofing works. Networks often trust the label on a message because checking every label costs time.

Who Gets Targeted, and Why?

Attackers go where disruption pays off or makes a point. Cloudflare says Media, Production and Publishing was the most attacked industry in both quarters, with 14.2% of mitigated HTTP DDoS requests. The Government sector jumped from 29th place to 9th in one quarter, the largest single-sector move of 2026 so far.

The report ties part of that rise to geopolitics. It describes a wave of hacktivist DDoS claims against organizations in 16 countries within 72 hours of strikes that began on February 28, 2026. Nearly half of the targeted organizations were government bodies.

This is a good place for a counterpoint. Attack counts depend on what Cloudflare can see, since it reports only on traffic across its own network. Other providers see different mixes. Treat the figures as a reliable view of one big slice of the internet, not a census of all of it. Cloudflare also publishes outage data, which we unpacked in how internet shutdowns work.

Did Police Action Change the Numbers?

Possibly. Cloudflare notes that activity peaked in April and then declined, which it links in part to Operation PowerOFF, a multi-country effort against DDoS-for-hire services. The report says that effort targeted more than 75,000 users and took down 53 domains, with 25 search warrants and four arrests.

The Operation PowerOFF entry on Wikipedia gives the longer history of those takedowns. Cloudflare is careful about cause and effect here, and so should you. A drop after a crackdown fits the story, but it does not prove it. Attackers shift tools and timing for many reasons.

The lesson for readers is that DDoS-for-hire is a real business. Some services sell attack time cheaply to people with no technical skill. Law enforcement hits those marketplaces because the buyers are the hardest to stop one by one.

What Does a DDoS Attack Look Like From Your Seat?

From your seat, a DDoS attack looks like a site that is slow or missing. CISA lists three common signs: unusually slow network performance, one particular website being unavailable and trouble reaching any website. These can look like routine outages, which is why attacks often go unnamed.

You cannot fix an attack on someone else's site. You can check whether the problem is yours. Try the same site on another network, such as mobile data. If it loads there, your own connection is the issue. If it fails everywhere, the site itself is struggling.

If you run a small site, the advice is practical. CISA suggests enrolling in a protection service that filters abnormal traffic and keeping a recovery plan ready. At Oddworldz, we would add one more habit, which is to know who hosts your DNS before a bad day arrives.

DDoS attacks are loud, cheap and often short. The 2026 numbers show them growing larger, but the defenses grew too. For most people, the story ends with a page that loads again a few minutes later.