In Q1 2025, Cloudflare blocked 20.5M DDoS attacks, up 358% YoY, and in Q2 it blocked an attack peaking at 4.8B packets per second, the most intense on record
The Cloudflare Blog : X: @cloudflare X: @cloudflare : 🚨 DDoS attacks are surging. In 2025 Q1, Cloudflare blocked +20M attacks (a 358% YoY spike) along with 5.6 Tbps and 4.8 Bpps record-breaking attacks. Read more in our latest DDoS Threat Report 👉 https://blog.cloudflare.com/ ...
Context & Ripple Effects
Cloudflare had already reported 21.3 million blocked DDoS attacks in 2024, with a sharp rise in attacks above 1 Tbps late in the year. This report indicates that both attack frequency and peak intensity accelerated into 2025.
The new packet-rate record extends a multi-year escalation from earlier application-layer attack records, including a 15.3 million-rps HTTPS attack in 2022. It matters because defense must absorb and filter attacks at both bandwidth and packet-processing scales.
First-order effects
- Cloudflare customers facing these campaigns receive automated mitigation at volumes that could otherwise overwhelm network links or application infrastructure.
- Cloudflare must keep expanding and tuning its DDoS mitigation capacity for unusually high packet rates as well as multi-terabit traffic floods.
Second-order effects
- Other CDN, cloud, and network-security providers face pressure to demonstrate comparable always-on mitigation capacity and detection speed, particularly for packet-intensive attacks.
- Organizations that rely on public internet services are likely to reassess whether their current upstream and DDoS protection arrangements can handle attacks beyond conventional bandwidth thresholds.
Third-order effects
- If attack volume and intensity continue rising together, large distributed edge networks may become a more important security control point, concentrating DDoS resilience among providers with global capacity.
- The pattern also shifts resilience planning from buying for a known peak to continuously validating automated mitigation against rapidly changing attack methods and scale.
The trend: DDoS defense is becoming an edge-scale capacity and automation contest as attackers raise both the number and processing intensity of floods.