Data: 9.1m DDoS attacks in H1 2026
October 14, 2026



NetScout Systems has released its first half 2026 Distributed Denial-of-Service (DDoS) Threat Intelligence Report, revealing a significant shift in how attacks are launched and sourced. With more than 9.1 million DDoS attacks recorded globally by NetScout between January and June 2026, the report highlights that DDoS risk is growing along three axes: the volume of traffic that must be inspected, the number of places where mitigation must be deployed, and the share of attacks that disrupt service without ever saturating a link.

“The 1,286 per cent rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine,” stated Hardik Modi, VP engineering, DDoS solutions, and Asert Threat Intelligence Team, NetScout. “With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient. Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication.”


Key findings include:

Massive attacks on a global scale – NetScout Atlas recorded more than 9.1 million DDoS attacks across 209 countries and territories, underscoring the expanding operational risk to enterprises and providers
Surge in high-impact capacity – attacks exceeding 1Tbps or 1Gpps increased 1,286 percent year-over-year, suggesting defenders must continue to prepare for greater attack intensity
IPv6 crossed the terabit threshold – NetScout observed its first IPv6 attack exceeding 1Tbps, while active mitigation of IPv6 attacks rose by more than 300 percent year-over-year even as IPv6’s share of attacks remained roughly flat, illustrating the need for robust IPv6 protection
Pressure on carrier mitigation – direct-path methods accounted for 64 percent of observed attacks and gained share for a third consecutive half-year, while carpet-bombing grew from 3.97 percent to 4.54 percent of attacks, and outbound attacks clearing 1Tbps/1Gpps caused operational impacts. Dedicated mitigation capacity remains the selective layer that providers need to intelligently filter malicious traffic
DDoS-for-hire and attack economics – attacks lasting one minute or less have roughly doubled as a share since 2H 2023, stressing connection tables, application backends, and resolvers, suggesting DDoS-for-hire platforms are shortening the path to attack
Residential proxy supply chain – by pairing residential proxy network tracking with DDoS telemetry, NetScout Asert identified residential proxy sources participating in DDoS attacks, highlighting that attack traffic can originate from harder-to-distinguish consumer IP addresses
NetScout maps the DDoS landscape through passive, active, and reactive vantage points, providing unparalleled visibility into global attack trends.

These findings show why DDoS resilience now depends on more than stopping the largest attack, suggests NetScout. Organisations need to recognise changing attack sources and methods, mitigate both inbound and outbound attacks, apply precise protection where services are exposed, and draw on cloud capacity when attacks exceed local defences. NetScout combines directly observed Atlas intelligence with on-premises and cloud-delivered mitigation to help customers protect service availability and sustain the digital operations their businesses depend on.