DDoS Attack Statistics: Attack Volumes, Record Sizes and Most Targeted Sectors

DDoS statistics are almost all published by the mitigation providers that absorb the traffic, so every figure describes one provider's customer base and one counting method, not the whole internet. This page collects the most cited recent DDoS figures from their original publishers: the Cloudflare quarterly DDoS threat reports for 2025, the Akamai State of the Internet (SOTI) security research for 2025 and 2026, and the European Union Agency for Cybersecurity (ENISA) sector threat landscape for public administration. Each figure carries its publisher, report and period in the same sentence or table row, and attacks are described in aggregate only. It is for security leaders, network and application teams, and risk owners who need defensible numbers for capacity planning, budget cases and tabletop exercises. Practical defence is covered in the DDoS Protection Guide; this page sticks to the numbers. Last reviewed: November 2026.

Key takeaways

• Attack counts more than doubled in 2025. Cloudflare reports mitigating 47.1 million DDoS attacks across 2025, up 121% on 2024, an average of 5,376 attacks every hour (Cloudflare 2025 Q4 DDoS threat report).
• Record sizes now run to tens of terabits. The largest attack Cloudflare reported for 2025 peaked at 31.4 Tbps and lasted 35 seconds, after a 29.7 Tbps record in Q3 2025 (Cloudflare 2025 Q3 and Q4 reports).
• Most attacks are short. In Q3 2025, 89% of network-layer attacks and 71% of HTTP attacks seen by Cloudflare ended in under 10 minutes, faster than any manual response.
• Application-layer DDoS keeps growing. Akamai's 2026 SOTI security report says Layer 7 DDoS attacks grew 104% over two years.
• Hacktivism drives DDoS against the public sector. ENISA found DDoS made up 60% of public administration incidents in the EU in 2024, and hacktivists accounted for nearly 63% of incidents.

How to read DDoS statistics

Before quoting any of the figures below, it helps to know what each publisher counts. The numbers are not comparable across publishers and should never be added together.

• Provider vantage point: a provider with more gaming or telecoms customers will see those sectors attacked more often. Rankings describe the provider's customer mix as well as attacker intent.
• Campaign effects: a single long campaign can swing a quarter. Cloudflare's 2025 Q1 report attributes 6.6 million network-layer attacks on its own infrastructure and 6.9 million on hosting and service providers to one 18-day campaign.
• Source versus origin: "top source" rankings in these reports describe where attack traffic entered the provider's network or where infected devices sit, not where the attacker is.

Attack volume statistics

Cloudflare publishes the most granular recurring volume series. The quarterly totals for 2025 tell a story of an unusually heavy first quarter followed by steady growth.

• Hourly rate: Cloudflare's 2025 average was 5,376 attacks mitigated per hour, of which 3,925 were network-layer and 1,451 were HTTP (2025 Q4 report). In Q3 2025 alone the average was about 3,780 per hour (2025 Q3 report).
• Network-layer surge: network-layer attacks more than tripled, from 11.4 million in 2024 to 34.4 million in 2025 (2025 Q4 report).
• Attacks on providers themselves: in Q1 2025, 6.6 million network-layer attacks targeted Cloudflare's own infrastructure and 6.9 million targeted hosting and service providers protected by it (2025 Q1 report). Cloudflare says these attacks were part of an 18-day multi-vector campaign. Infrastructure providers are targets in their own right.

Record attacks and hyper-volumetric statistics

Cloudflare uses "hyper-volumetric" for attacks above 1 terabit per second (Tbps) or 1 billion packets per second (Bpps). Records were broken repeatedly through 2025.

• Botnet scale: Cloudflare estimates the Aisuru botnet (later tracked with Kimwolf) at between 1 and 4 million infected hosts (2025 Q3 and Q4 reports). Botnets of compromised routers and Internet of Things devices are what make tens of terabits possible.
• Large attack growth: in Q3 2025, attacks above 1 Tbps rose 227% and attacks above 100 million packets per second rose 189% quarter on quarter (2025 Q3 report).
• Collateral impact: Cloudflare's Q3 2025 report notes disruption to internet service providers whose networks carried the botnet's traffic, a reminder that upstream networks feel these attacks too.

Application-layer (Layer 7) DDoS statistics

• Two-year growth: Akamai's 2026 SOTI security report, "Convergence crisis: AI attacks move from web apps to APIs to DDoS", states that Layer 7 DDoS attacks surged by 104% over two years. The same report says the average number of API attacks rose 113% year on year.
• Quarterly growth: Akamai's 2025 year in review (published 11 December 2025) cites 94% growth in quarterly application-layer DDoS attacks and describes multi-terabit network attacks as a regular occurrence.
• HTTP attack volumes: Cloudflare mitigated 4.1 million HTTP DDoS attacks in Q2 2025, up 129% year on year, and about 20 million HTTP attacks above 1 million requests per second in that quarter (2025 Q2 report).
• Who sends HTTP floods: in Q3 2025 about 70% of HTTP DDoS attacks came from botnets Cloudflare already knew, about 20% from fake or headless browsers or suspicious HTTP attributes, and about 10% from other methods such as cache busting and attacks on login endpoints (2025 Q3 report).
• Size in Q4 2025: Cloudflare reports HTTP attack volume stayed flat in Q4 2025 but attack size rose to levels not seen since the 2023 HTTP/2 Rapid Reset campaign (2025 Q4 report).

Application-layer floods matter because they target the expensive parts of a service: login, search, checkout and API endpoints. They are also where bot management and API protection overlap with DDoS defence. See the API Security Statistics page for the API side.

Attack duration and size distribution

The pattern is a long tail: the vast majority of attacks are small and short, while a small number of very large bursts set the records. Small attacks can still take down an unprotected origin or a single VPN concentrator, so the median matters as much as the record for most organisations.

Targeted sectors and countries

Industry and country rankings shift every quarter and reflect each provider's customer base. Treat them as signals of where attackers are active, not as a risk score for your sector.

• AI services: Cloudflare's Q3 2025 report records HTTP attack traffic against AI companies rising by as much as 347% month on month in September 2025, and its Q4 2025 report names generative AI customers among those heavily hit by hyper-volumetric attacks.
• Public administration: ENISA's Sectorial Threat Landscape for Public Administration found DDoS made up 60% of public administration incidents in 2024 (ENISA press release, 6 November 2025).
• Traffic sources: Indonesia was the top source of DDoS traffic to Cloudflare for about a year up to Q3 2025, and Bangladesh replaced it in first place in Q4 2025 (2025 Q3 and Q4 reports). Source rankings reflect where infected devices and abused networks sit.

Who is behind DDoS attacks

• Hacktivists: ENISA's public administration threat landscape for 2024 found hacktivists were the most prevalent actor by volume, behind nearly 63% of incidents, ahead of cybercrime operators (about 16%) and state-nexus intrusion sets (about 2.5%), with hacktivists primarily resorting to DDoS. See the NoName057 DDoS Hacktivist Group Profile Guide for one such group.
• Victims' own view: in Cloudflare's Q2 2025 customer survey, 71% of attacked customers did not know who attacked them. Of the 29% who named an actor, 63% pointed to competitors and 21% to state-level actors, with 5% each naming extortionists, disgruntled customers or users, and accidental self-inflicted DDoS (2025 Q2 report).
• Ransom DDoS: the share of attacked Cloudflare customers reporting ransom DDoS attacks or threats rose 68% quarter on quarter in Q2 2025, and around a third of respondents reported them in June 2025 (2025 Q2 report).
• Botnets for hire: Cloudflare's Q3 2025 report says portions of the Aisuru botnet were reportedly rented out for a few hundred to a few thousand US dollars, which keeps large attacks within reach of low-skilled actors.

What the numbers mean for defenders

• Automate mitigation: with most attacks over in under 10 minutes, any defence that needs a human to divert traffic will arrive after the attack ends. Always-on or automatically triggered mitigation is the baseline. The DDoS Protection Guide covers the options.
• Size for bursts, not averages: on-premises scrubbing and single upstream links cannot absorb multi-terabit floods. Upstream options such as remotely triggered black hole routing and Flowspec are covered in the RTBH and BGP Flowspec DDoS Mitigation Guide.
• Protect expensive endpoints: the growth in Layer 7 floods and login-endpoint abuse means rate limits, bot controls and caching on login, search and API routes matter as much as raw bandwidth.
• Plan for collateral damage: attacks on hosting providers, carriers and DNS services hit their customers too. Map your dependencies, including DNS and CDN, and ask suppliers how they handle attacks on their own infrastructure.
• Treat ransom notes as a playbook trigger: rising ransom DDoS reports call for a pre-agreed response. The DDoS Response Playbook sets out roles and decisions.
• Keep the identity angle in view: attacks on login and token endpoints can lock users out or mask credential stuffing. Monitor authentication failure rates alongside traffic volume during an event.

Common mistakes when using DDoS statistics

• Adding providers together: Cloudflare's and Akamai's figures overlap in scope and differ in method. Quote each with its source.
• Quoting a record as typical: a 31.4 Tbps peak is real but rare; 99% of network-layer attacks in Cloudflare's Q1 2025 data were under 1 Gbps.
• Reading source countries as attacker nationality: source rankings show where traffic enters a network, often from infected devices.
• Ignoring campaign skew: the Q1 2025 total includes one 18-day campaign; year-on-year growth figures carry that effect.
• Using stale numbers: these series change every quarter. Check the publisher's latest edition before a board paper.

Practitioner checklist

• Quote every DDoS figure with publisher, report name and period, and never combine figures from different providers.
• Check the latest Cloudflare quarterly report and Akamai SOTI edition before presenting numbers.
• Confirm mitigation is always-on or automatically triggered, given that most attacks end within 10 minutes.
• Compare your upstream and provider capacity with current record sizes, and document the gap and the plan to close it.
• Apply rate limits and bot controls to login, search, checkout and API endpoints.
• Map DNS, CDN, hosting and carrier dependencies and confirm each supplier's DDoS arrangements.
• Rehearse a ransom DDoS scenario using the DDoS Readiness Checklist.
• Track time to mitigate, peak attack size absorbed and availability during attacks as recurring metrics.

Standards and references

• Cloudflare: 2025 Q4 DDoS threat report
• Cloudflare: 2025 Q3 DDoS threat report
• Cloudflare: 2025 Q2 DDoS threat report
• Cloudflare: 2025 Q1 DDoS threat report
• Akamai: 2026 SOTI security report, Convergence crisis
• Akamai: The Year in Review 2025
• ENISA: Public administration increasingly targeted by DDoS attacks
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: DDoS Protection Guide · DDoS Response Playbook · DDoS Protection Buyer's Guide · Cybersecurity Statistics Guide