More than 9.1 million attacks were recorded globally, with weaponised residential proxies and increasingly short-duration assaults adding pressure on network defences.
NETSCOUT’s first-half 2026 DDoS Threat Intelligence Report highlights a sharp escalation in high-capacity distributed denial-of-service (DDoS) attacks, signalling growing challenges for enterprises and network operators. The company recorded more than 9.1 million attacks across 209 countries and territories between January and June 2026.
Attacks exceeding 1 terabit per second (Tbps) or 1 billion packets per second (Gpps) surged 1,286% year over year, underscoring the growing need for greater mitigation capacity and more precise traffic filtering.
“The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine,” said Hardik Modi, VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team at NETSCOUT. He warned that residential proxies and short, rate-based attacks from DDoS-for-hire platforms are exposing the limitations of traditional network controls.
“High-capacity DDoS attacks are no longer anomalies; they are becoming routine.” — Hardik Modi, VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team, NETSCOUT
The report also identified NETSCOUT’s first observed IPv6 attack exceeding 1Tbps. Active mitigation of IPv6 attacks increased by more than 300% year over year, highlighting the need to strengthen protection across network protocols.
Direct-path techniques accounted for 64% of observed attacks, while carpet-bombing attacks increased their share from 3.97% to 4.54%. Meanwhile, attacks lasting one minute or less have roughly doubled as a proportion of incidents since the second half of 2023, potentially placing pressure on connection tables, application backends and DNS resolvers.
NETSCOUT also identified residential proxy sources participating in DDoS attacks, illustrating how malicious traffic can originate from consumer IP addresses that are harder to distinguish from legitimate users.
The findings point to a broader shift in DDoS defence requirements. Organisations increasingly need distributed mitigation, stronger network-edge protection and cloud-based capacity to counter attacks that target service availability without necessarily saturating network links.
NETSCOUT combines global attack visibility through its ATLAS intelligence network with on-premises and cloud-delivered mitigation capabilities to help enterprises and service providers protect critical digital services.