DDoS attacks can knock services offline before links reach capacity

More than 9.1 million DDoS attacks were recorded globally between January and June 2026, an increase of nearly a quarter year over year, according to Netscout’s DDoS Threat Intelligence Report.

Large attacks and distributed targeting strain defenses

Attacks exceeding 1 Tbps or 1 Gpps increased 1,286% year over year. Much of that growth came from botnet operators associated with Aisuru, Kimwolf, Jackskid, and their successors. That means attackers need fewer devices to launch large attacks.

“With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient. Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication,” said Hardik Modi, VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team, NETSCOUT.

Many of these attacks overwhelm network equipment with huge numbers of packets, requests and connections. Firewalls and load balancers can run out of resources to process them even before the network’s bandwidth is exhausted.

Attacks delivering billions of packets per second have overwhelmed individual router components known as line cards where protective measures were missing. When a card stops forwarding traffic, it can disconnect customers and networks that were not targeted.

IPv6 accounted for roughly the same share of observed attacks as a year earlier, but those attacks became more demanding. ATLAS recorded its first IPv6 attack exceeding 1 terabit per second in the first half of 2026, while active mitigation of IPv6 attacks increased by more than 300%.

DDoS attacks by six-month interval: direct path vs reflection/amplification. (Source: Netscout)

Direct-path attacks, which send traffic straight to a target, accounted for 64.4% of observed attacks. Their share grew for a third consecutive six-month period.

Carpet-bombing attacks rose from 3.97% of observed attacks in the first half of 2025 to 4.54% in the first half of 2026. These attacks spread traffic across many destination addresses within a network prefix. Traffic to each address can remain below detection thresholds as the combined volume overwhelms the network or shared infrastructure.

Single-method attacks accounted for 52.27% of observed attacks. Common techniques included TCP floods targeting connection-handling resources, DNS attacks and reflection/amplification floods.

Service providers applied mitigation to 23.12% of observed attacks, compared with 22.35% a year earlier. Growth in total attacks increased both the number mitigated and the number reaching their targets. Provider controls often prioritize shared infrastructure, with customer protection supplied through dedicated DDoS services.

Providers need more dedicated filtering capacity at network edges, and enterprises need protection close to their services. Broad blocking measures can disrupt customers when attacks span many addresses. Outbound and transit attack traffic can degrade the networks carrying it.

DDoS-for-hire platforms lower barriers to attack

DDoS-for-hire services offer subscription plans, free trials, method catalogues and control panels with preconfigured settings that reduce the technical effort needed to launch attacks.

Every service reviewed had its launch form set to a single attack lasting 60 seconds, with a free method selected. Across all observed incidents, attacks lasting one minute or less rose from 1.6% in the second half of 2023 to 3.1% in the first half of 2026. Longer attacks continued to account for the majority.

Sellers promote methods they claim can bypass specific defenses, emphasizing packet, connection and request rates over bandwidth alone. These attacks can overwhelm network equipment and applications without filling the target’s internet connection. The bypass claims have not been independently verified.

Some platforms advertise large pools of IP addresses, including residential connections that can make malicious traffic harder to distinguish from ordinary users.

Matching subscription tiers and near-identical backend technology indicate that competing storefronts may share infrastructure. Advertised plans range from free access to around $20,000 a month. A small number of operators may therefore support many storefronts, potentially narrowing the target set for disruption.

Residential proxies complicate attack detection

Residential proxy networks route traffic through consumer devices using addresses assigned to home and mobile internet connections. Researchers paired proxy infrastructure tracking with DDoS telemetry to identify sources participating in attacks.

Some users agree to share their connections for payment. Others become proxy hosts through apps that enable connection sharing without informed consent or hardware shipped with proxy software. These networks serve commercial uses, including advertising verification and geographic testing. Some carry DDoS traffic.

Address-based blocking is unreliable because home IP addresses change and proxy customers switch nodes frequently. Defenders can identify coordinated behavior, including sources contacting the same destination, changing traffic rates together or repeating protocol patterns.

Tracking the backhaul systems that proxy clients contact can help providers identify participating hosts on their own and downstream customer networks. Backhaul addresses often remain stable for weeks or months. Detecting and suppressing attack traffic from those hosts requires separate controls.