DDoS Attack Statistics & Research 2026

DDoS Attack Statistics 2026

The following statistics are drawn from published vendor reports (Cloudflare, AWS, Akamai, NETSCOUT) and protocol documentation. Amplification ratios are independently calculated from IETF specifications and confirmed against academic literature.

What Is a DDoS Attack?

A Distributed Denial of Service (DDoS) attack floods a target - a server, network infrastructure, or application - with traffic from multiple sources simultaneously, exhausting its resources and making it unavailable to legitimate users. The "distributed" component is what separates DDoS from a simple DoS attack: traffic originates from hundreds, thousands, or tens of thousands of compromised machines, making IP-level blocking ineffective.

DDoS attacks operate across three layers of the network stack. Volumetric attacks saturate the target's available bandwidth with junk traffic. Protocol attacks exhaust connection-state resources (TCP SYN table, firewall state entries) using protocol-level abuse. Application-layer attacks send valid-looking HTTP requests that exhaust server CPU and database resources at far lower bandwidth than volumetric attacks require.

Amplification Factor Analysis (Protocol-Verified)

Amplification factors are calculated from packet-level analysis of each protocol's request and maximum response size. The formula is: Amplification = max_response_bytes / request_bytes. These ratios are verifiable against the IETF RFCs and CAIDA amplification surveys.

Calculated example: 1 Gbps source vs. memcached reflectors

An attacker with 1 Gbps of upload bandwidth sending 15-byte memcached requests is transmitting approximately 8.3 million packets per second (1,000,000,000 / 8 / 15 = ~8.3M pps). Each packet triggers a response of up to 768,000 bytes. With full amplification: 8.3M × 768,000 bytes = ~50.9 Tbps theoretical output directed at the victim. In practice, reflector response rates, network saturation, and ISP filtering reduce real-world numbers to roughly 10-20% of the theoretical maximum - still yielding 5-10 Tbps from a 1 Gbps source.

Record DDoS Attacks by Year

The following table documents the largest publicly confirmed DDoS attacks. All entries cite the original vendor disclosure or incident report.

DDoS Attack Cost Analysis

The following cost estimates are derived from commercial transit pricing, public cloud scrubbing rates, and published commercial stresser pricing. All figures are in USD.

Attack-side bandwidth cost

A 100 Gbps direct-path UDP flood requires approximately 100 Gbps of sustained upload capacity. At commercial dedicated server pricing (~$0.50-2.00 per Mbps/month for burstable transit), sustaining 100 Gbps for one hour costs roughly $70-280 in raw bandwidth. With NTP amplification (557x), the same 100 Gbps of victim-bound traffic requires only 180 Mbps of source bandwidth - costing approximately $0.13-0.50/hour in transit alone. This asymmetry is the core economic challenge of DDoS defense.

Defense-side costs

DDoS Attack Types

The table below covers all major DDoS attack vectors with their layer, typical volume, and the primary mitigation that addresses each. Multi-vector DDoS attacks combine two or more of these methods simultaneously to defeat single-layer defenses.

How a DDoS Attack Works

A DDoS attack requires three components: a command-and-control (C2) layer that coordinates the attack, a botnet or reflector network that generates the traffic, and a target. The attacker sends commands to the C2 layer, which relays instructions to compromised nodes. Each node sends traffic toward the target simultaneously.

Direct-path botnet attack

In a direct-path attack, each compromised machine in the botnet sends packets directly to the target IP. The Mirai botnet (2016) used approximately 600,000 IoT devices to generate ~1.2 Tbps of DNS flood traffic against Dyn. The 2024 record attack used only 13,000 IoT devices to reach 5.6 Tbps - indicating each device averaged ~430 Mbps, suggesting exploitation of high-bandwidth home routers or small servers rather than cameras and DVRs as in Mirai.

Reflection/amplification attack

The attacker spoofs the victim's source IP in UDP packets sent to thousands of open reflector servers. Each reflector server sends its (much larger) response to the victim's IP. The victim receives amplified traffic from millions of legitimate IP addresses worldwide - making it impossible to block by source IP. BCP38 (RFC 2827) - filtering spoofed packets at ISP egress - is the only infrastructure-level countermeasure, but adoption remains incomplete globally (~40% of ASNs as of 2024 according to CAIDA Spoofer Project).

HTTP/2 Rapid Reset (CVE-2023-44487)

Disclosed in October 2023, this zero-day exploited HTTP/2 stream multiplexing. A client opens a stream, immediately sends RST_STREAM to cancel it, then repeats millions of times per second per connection. Each RST_STREAM triggers server-side allocation and teardown. Cloudflare observed 398 million requests per second from just 20,000 machines - approximately 20,000 RPS per node. The attack was patched via server-side rate limiting of RST_STREAM messages.

DDoS Attack Protection

Effective DDoS protection requires layering defenses across all three attack categories. No single product stops all DDoS attack types. The standard defense stack:

Legal vs Illegal DDoS Testing

A DDoS attack conducted without the target owner's authorization is a criminal offence in every jurisdiction that has computer crime legislation. The same technical mechanism - sending high-volume traffic toward a specific IP - is legal when conducted by the infrastructure owner (or with their written authorization) for load testing and DDoS resilience verification.

Three UK-registered companies operate legal IP stresser services in 2026: overload.su (78 OVER 37 LIMITED), ddos.su (JD DEVELOPMENT SOLUTIONS LTD), and unknownstresser.su (Energy Leverage Production LTD). All three are incorporated, run Google Ads (which requires advertiser resource verification for stress-testing services), and restrict usage to infrastructure the client owns or is authorized to test.

Legal Status by Country

Unauthorized DDoS attacks are criminal in every major jurisdiction. Authorized testing of infrastructure you own is legal everywhere. The table lists the specific statutes and maximum penalties for unauthorized DDoS attacks.

Frequently Asked Questions