Hyper-volumetric DDoS attacks skyrocket: Cloudflare’s 2025 Q2 DDoS threat report

Record-Breaking Volumes and a Shift in Attack Patterns

Cloudflare’s Q2 2025 DDoS report documents a quarter of extremes. While the total number of attacks fell sharply from the unprecedented surge seen in Q1, the quarter was defined by a massive jump in the most extreme traffic volumes. June was the most active month, accounting for nearly 38% of all observed activity for the quarter. One prominent target during this period was an independent Eastern European news outlet that reported being attacked following its coverage of a local Pride parade.

The headline figure is the mitigation of the largest DDoS attacks ever reported. Cloudflare’s autonomous defenses blocked attacks peaking at 7.3 Tbps and 4.8 billion packets per second (Bpps). In total, the network mitigated over 6,500 hyper-volumetric attacks, which include L3/4 attacks exceeding 1 Bpps or 1 Tbps, and HTTP attacks exceeding 1 million requests per second (Mrps). This equates to an average of 71 such extreme events per day. The number of attacks exceeding 100 million packets per second (pps) surged by 592% quarter-over-quarter, while those exceeding 1 Bpps or 1 Tbps doubled.

A Mid-Year Slowdown Following a Q1 Campaign

Despite the record peaks, the overall volume of attacks decreased in Q2. Cloudflare mitigated 7.3 million DDoS attacks, a sharp drop from the 20.5 million handled in Q1. That previous quarter’s total was inflated by an 18-day campaign that generated 13.5 million attacks against Cloudflare’s own infrastructure and other protected networks. The mid-year totals still show an elevated threat landscape, however. The first half of 2025 saw 27.8 million attacks blocked, equivalent to 130% of all attacks mitigated in the full calendar year 2024.

The quarterly breakdown shows diverging trends by layer. L3/4 DDoS attacks plunged 81% quarter-over-quarter to 3.2 million. In contrast, HTTP DDoS attacks rose 9% to 4.1 million. Year-over-year, the overall picture remains considerably more intense, with total attacks up 44% compared to Q2 2024. HTTP DDoS attacks saw the steepest annual increase at 129%.

Attribution and Ransom Trends

When asked about the perpetrators, the vast majority of attacked Cloudflare customers (71%) said they did not know who was responsible. Among the 29% who believed they had identified the actor, 63% pointed to competitors—a pattern especially common in the Gaming, Gambling, and Crypto industries. State-level or state-sponsored actors were blamed by 21% of these respondents. The remaining 16% was split nearly evenly among self-inflicted attacks, extortionists, and attacks from disgruntled customers.

Ransom DDoS activity grew notably during the quarter. The percentage of attacked customers reporting a Ransom DDoS attack or threat increased by 68% compared to Q1. This trend accelerated toward the end of the quarter, with around a third of respondents in June reporting such threats—a 6% increase year-over-year.

Geographic and Industry Targets

The ranking of the most targeted locations saw significant movement. China climbed two spots to reclaim the top position, with Brazil jumping four places to second. Germany slipped to third, while India and South Korea rose to fourth and fifth, respectively. Notable surges included Russia, which rocketed forty places to ninth, and Azerbaijan, which climbed thirty-one spots to round out the top ten. These rankings are based on the billing country of the attacked customer, not the physical location of the traffic, so a high rank does not necessarily indicate direct geopolitical targeting.

The telecommunications sector returned to the top of the most-attacked industries list, climbing one spot to first place. The Internet sector jumped two spots to second, followed by Information Technology & Services in third. Agriculture made a dramatic 38-place leap into eighth, while Government rounded out the top ten.

Sources: Botnets and Infrastructure

For the first time in about a year, the German network Hetzner (AS24940) is no longer the leading source of HTTP DDoS attacks, falling to third place. It was replaced by fellow German provider Drei-K-Tech-GmbH (AS200373), which jumped six spots. The US-based DigitalOcean (AS14061) moved up one place to second.

The source infrastructure data points to the continued dominance of virtual machine-based botnets. Nine of the top ten source ASNs offer VMs, hosting, or cloud services. These VM-based botnets are estimated to be 5,000x stronger than their IoT-based counterparts. The only exception in the top ten is ChinaNet Backbone (AS4134), which is primarily an ISP without significant public VM offerings. Notably, Indonesia climbed to the top spot as the largest source of DDoS traffic, followed by Singapore and Hong Kong.

To combat this issue, Cloudflare provides a free DDoS Botnet Threat Feed for Service Providers. Over 600 organizations have signed up for the feed, which offers a list of offending IP addresses within a provider’s own ASN that are observed launching HTTP DDoS attacks. Access requires a free Cloudflare account and ASN authentication via PeeringDB, after which the intelligence can be fetched via a simple API call.

Attack Vectors and Defenses

The majority of HTTP DDoS attacks in Q2 (71%) were launched by known botnets. Cloudflare attributes its rapid detection and mitigation capabilities to its large network and real-time threat intelligence. Once a botnet is identified while targeting a single website or IP, protections are immediately extended across the entire network and customer base. The system is designed to adapt as botnets morph and change their nodes.

What’s driving the L3/4 attack mix

DNS floods were the leading L3/4 attack vector in Q2 2025, accounting for nearly a third of all L3/4 DDoS attacks. SYN floods slipped to second place, dropping from 31% in Q1 to 27% in Q2. UDP floods took third, climbing from 9% to 13% quarter over quarter. RST floods, another TCP-based vector, held fourth place at 5% of all L3/4 attacks. SSDP floods rounded out the top five at 3% — a decline from 4.3% last quarter, but enough to displace Mirai attacks, which plunged from 18% in Q1 to just 2% in Q2.

^{The top L3/4 DDoS attack vectors for 2025 Q2}

The dominant vectors and how to respond

The three most common L3/4 attack types are all flood-based. Each presents different defensive considerations, particularly around avoiding collateral damage to legitimate traffic.

DNS floods

• Type: Flood
• How it works: A DNS flood overwhelms a DNS server with a high volume of queries — valid, random, or malformed — to exhaust CPU, memory, or bandwidth. Unlike amplification attacks, this is a direct flood aimed at degrading performance or causing outages, typically over UDP port 53 but sometimes over TCP (especially for DNS-over-TCP or DNSSEC-enabled zones).
• How to defend: Cloudflare DNS as primary or secondary, Cloudflare DNS Firewall, and/or Cloudflare Magic Transit absorb and mitigate query floods before they reach the origin. Cloudflare’s global network handles tens of millions of DNS queries per second with built-in DDoS filtering and query caching, blocking malformed or excessive traffic while answering legitimate requests.
• Avoiding unintended impact: Blocking all DNS traffic or disabling UDP port 53 breaks normal resolution. Use DNS-specific protection such as the Advanced DNS Protection system, and deploy DNSSEC-aware protection to handle TCP-based query floods safely.

SYN floods

• Type: Flood
• How it works: Attackers send a large volume of TCP SYN packets — often with spoofed IP addresses — initiating connections that never complete. The target is left with half-open connections that consume memory and connection tracking resources, potentially exhausting server limits and preventing legitimate clients from connecting.
• How to defend: Cloudflare Magic Transit intercepts and mitigates TCP SYN floods at the edge using SYN cookies, connection tracking, and behavioral analysis to distinguish real clients from spoofed or malicious sources. Reverse-proxy services such as the CDN/WAF for HTTP or Cloudflare Spectrum for TCP can effectively eliminate the impact of TCP-based DDoS attacks.
• Avoiding unintended impact: Blocking all SYN traffic or applying aggressive timeouts can block real users. Cloudflare’s Advanced TCP protection system uses SYN rate shaping, anomaly detection, and spoofed-packet filtering to mitigate attacks without affecting genuine connections.

UDP floods

• Type: Flood
• How it works: High volumes of UDP packets are sent to random or specific ports on target IP addresses, saturating the internet link or overwhelming in-line appliances with more packets than they can handle, causing disruption or outage.
• How to defend: Deploy cloud-based volumetric DDoS protection that fingerprints attack traffic in real time — such as Cloudflare Magic Transit or Cloudflare Spectrum — apply smart rate-limiting on UDP traffic, and drop unwanted UDP traffic entirely with Magic Firewall.
• Avoiding unintended impact: Aggressive filtering may disrupt legitimate UDP services such as VoIP, video conferencing, or online games. Apply thresholds carefully.

Legacy vectors return with new intensity

While HTTP floods still dominate the threat landscape, the fastest-growing L3/4 attacks in Q2 2025 came from recycled and obscure protocols. Teeworlds floods — targeting the open-source 2D multiplayer game's UDP-based protocol — jumped 385% quarter-over-quarter. RIPv1 floods, which abuse an unauthenticated distance-vector routing protocol over UDP/520, surged 296%. RDP floods grew 173%, Demon Bot floods rose 149%, and even the legacy VxWorks flood climbed 71%. The pattern is clear: attackers are actively probing lesser-known protocols to slip past standard defenses.

Anatomy of the top emerging threats

These attacks lean heavily on reflection, amplification, and botnet-driven floods. Each requires a slightly different mitigation approach, and avoiding collateral damage to legitimate traffic is a recurring concern.

Teeworlds floods work by flooding game servers with spoofed or excessive UDP packets that mimic in-game actions or connection attempts, overwhelming server resources. Cloudflare Spectrum and Magic Transit provide real-time fingerprinting to block the attack traffic while letting genuine players through. When crafting custom rules, avoid broadly blocking or aggressively rate-limiting UDP port 8303 directly — that can disrupt gameplay entirely.

RIPv1 reflection attacks exploit a protocol that was largely obsolete even before the millennium. Attackers send spoofed routing updates to generate unwanted traffic. The simplest defense is also the most thorough: disable RIPv1 on routers entirely and use RIPv2 with authentication where routing updates are still needed. Blocking inbound UDP/520 from untrusted networks and monitoring for unexpected routing updates adds another layer. Since RIPv1 is mostly obsolete, disabling it carries little risk.

RDP reflection and amplification abuse the Remote Desktop Protocol, which typically runs over TCP port 3389. Misconfigured setups may respond to unauthenticated connection attempts, enabling attackers to bounce spoofed initiation packets off exposed servers toward a victim. Cloudflare Magic Transit filters malformed RDP traffic at the network edge. For organizations that still need RDP, avoid global blocks on TCP/3389. Instead, restrict access to known IPs or internal networks — or remove public exposure entirely with Cloudflare Tunnel and Zero Trust Network Access.

DemonBot is a malware strain that infects Linux-based systems, particularly unsecured IoT devices, often via open ports or weak credentials. Infected devices form botnets capable of high-volume UDP, TCP, and application-layer floods, typically targeting gaming, hosting, and enterprise services. Magic Transit absorbs network-layer floods with signature-based detection; WAF and DDoS protection handle HTTP floods and connection abuse. Adaptive mitigation combined with IP reputation filtering, geo-blocking, and rate limiting helps keep false positives low.

VxWorks floods weaponize a real-time operating system used in millions of embedded devices. Outdated or misconfigured versions are compromised via public exploits or weak credentials, turning the devices into bots that send high volumes of UDP, TCP, or ICMP traffic. Magic Transit uses real-time fingerprinting and heuristics to identify traffic from compromised VxWorks devices. Avoid over-blocking UDP or ICMP — legitimate diagnostics and real-time services may depend on those protocols.

Scale and duration: the devil is in the details

Most DDoS attacks remain small and short-lived. In Q2 2025, 94% of L3/4 attacks stayed below 500 Mbps and roughly 85% stayed below 50,000 packets per second. On the application layer, 65% of HTTP DDoS attacks stayed below 50K requests per second.

But "small" is relative. An average modern server — roughly 4–8 CPU cores, 16–64 GB RAM, and a 1 Gbps NIC running NGINX or similar — can handle about 100,000–500,000 pps, up to ~940 Mbps throughput, and roughly 10,000–100,000 rps for static content. For database-backed dynamic applications, that figure drops to 500–1,000 rps. Even a "small" attack can overwhelm an unprotected server.

The real concern is at the extreme end of the scale. Hyper-volumetric attacks are growing in both size and frequency: 6 out of every 100 HTTP DDoS attacks now exceed 1M rps, and 5 out of every 10,000 L3/4 attacks exceed 1 Tbps — a 1,150% quarter-over-quarter increase in that category.

Even at that scale, attacks are often brief. Threat actors favor short, intense bursts — occasionally lasting as little as 45 seconds — to evade detection and disable defenses before they can fully activate. Continuous, always-on protection is therefore essential.

Proactive defense as the standard

With a network capacity of 388 Tbps across 330+ cities, Cloudflare provides automated, in-line mitigation for all attack types. The company also offers free, unmetered DDoS protection regardless of size or duration, and contributes to botnet takedowns through its free ISP Botnet Threat Feed. The data indicates that proactive, always-on security is measurably more effective than reactive adoption or legacy mitigation systems.