New report highlights unprecedented surge in hyper-volumetric, network-layer, and protocol-based DDoS threats across sectors and geographies.
Cloudflare has released its Q1 2025 DDoS Threat Report, revealing a dramatic escalation in distributed denial-of-service (DDoS) attacks. The company’s systems mitigated 20.5 million attacks—nearly matching the 21.3 million mitigated in all of 2024.
Among the most alarming trends: a 509% year-over-year spike in network-layer attacks, a surge in hyper-volumetric attacks exceeding 1 Tbps or 1 billion packets per second, and a massive rise in protocol-based threats such as CLDAP and ESP amplification attacks.
“Proactive security, not reactive responses, is the key to withstanding modern DDoS attacks.”
— Bashar Bashaireh, AVP – Middle East, Türkiye & North Africa, Cloudflare
Germany emerged as the most targeted country, followed by Turkey and China. On the flip side, Hong Kong was the leading source of attacks, ahead of Indonesia and Argentina. The Gambling & Casinos industry was the top target, with Airlines & Aerospace registering the biggest jump—up 40 places to the top 10.
Cloudflare also reported a 3,488% increase in CLDAP-based reflection attacks and a 2,301% spike in ESP protocol abuse, revealing attackers’ growing use of misconfigured systems and legacy vulnerabilities.
Despite the scale, most attacks were under 1 Gbps and lasted less than 10 minutes—too short for manual defense. “Automation and an always-on strategy are critical,” said Bashar Bashaireh. “Our focus is on proactive, unmetered protection regardless of attack size or duration.”
With over 348 Tbps of global capacity, Cloudflare continues to offer inline, real-time DDoS mitigation to keep enterprises resilient amid evolving threats.
