Targeted by 20.5 million DDoS attacks, up 358% year-over-year: Cloudflare’s 2025 Q1 DDoS Threat Report
Apr 28, 2025Omer Yoachimik, Jorge Pacheco
Summary
This post details the significant increase in DDoS attacks observed in Q1 2025, with a 358% YoY increase and 198% QoQ increase, totaling 20.5 million blocked attacks. It highlights the evolution of Cloudflare's autonomous defenses in handling hyper-volumetric attacks, including record-breaking campaigns of 4.8 Bpps and 6.5 Tbps. The post also analyzes emerging threat vectors like CLDAP and ESP reflection attacks, and discusses the anatomy of both network-layer and HTTP-layer DDoS attacks, including the prevalence of SYN floods, Mirai botnets, and botnet-impersonating attacks. It also touches on threat actor motivations and the short duration of most attacks, necessitating rapid, automated mitigation.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack