- Netscout recorded more than 9.1 million DDoS attacks in the first half of 2026. It says many exhaust firewalls and load balancers before bandwidth runs out.
- Rented attack services default to a free, 60-second attack, and residential proxies make address blocking unreliable, according to Netscout.
- Test resilience by packet and connection rates, confirm what your provider covers, and check whether dedicated DDoS protection sits close to your services.
The street is clear, but the checkout is stuck
Many leaders picture a DDoS attack as a flood that fills a company's internet connection. Netscout's threat report, covered by Help Net Security, points to another failure. Equipment can reach its limit first.
Think of a shop on a wide street. A crowd does not need to block the street to stop trade. It only needs everyone to ask the one cashier a question. The street is clear, yet nobody is served. The lesson here is that bandwidth tells you how wide the road is. It does not tell you how fast the checkout works.
How the equipment reaches its limit
Every packet, request or connection costs a device a little work. Firewalls and load balancers can only do so much of that work at once. Netscout says many attacks use sheer volume of these small items. A device can hit its ceiling while the internet link still has room.
A line card is a part inside a router that moves traffic. Netscout reports that attacks of billions of packets per second have knocked out single cards where protections were missing. A card that stops passing traffic can cut off bystanders. These are customers and networks that were never the target.
Carpet-bombing is a different tactic. The attacker spreads traffic over many addresses in one block of a network. Each address gets a modest share, so alerts set per address may stay quiet. The shares add up to a heavy load on the network or shared systems.
The tactic is still a small slice of all attacks, but it grew. Netscout's data shows 3.97% of observed attacks a year earlier and 4.54% in the first half of 2026.
Netscout links much of the rise in very large attacks to botnets tied to Aisuru, Kimwolf, Jackskid and their successors. A botnet is a network of hijacked devices. The report says attackers now need fewer devices to launch a large attack.
Attacks are cheap, short and easy to start
Netscout also studied DDoS-for-hire sites. These sell subscriptions, free trials, lists of attack methods and dashboards with ready-made settings. That cuts the skill needed to launch an attack.
Every service Netscout reviewed opened with its launch form set to one 60-second attack and a free method. Advertised plans run from free to about $20,000 a month.
Longer attacks are still the majority. Even so, a short attack can end before a team has opened a ticket.
Sellers claim their methods get past specific defences. They stress rates of packets, connections and requests over raw bandwidth. Netscout says these claims have not been independently verified.
Rival sites also show matching price tiers and near-identical backend technology. Netscout says this suggests the storefronts may share infrastructure. A small number of operators may therefore support many of them.
Blocking addresses is a weak defence
A residential proxy network sends traffic through ordinary home and mobile connections. Attack traffic routed this way can look like normal users.
Some owners agree to share their connection for payment. Others join through apps that share it without informed consent, or through hardware shipped with proxy software. These networks also serve lawful uses, such as ad verification and geographic testing. Some carry DDoS traffic.
Netscout says blocking by address is unreliable. Home addresses change, and proxy customers switch nodes often. Defenders can watch behaviour instead. Signs include many sources hitting one destination, rates that rise and fall together, or repeated protocol patterns.
The servers that proxy clients contact often keep the same addresses for weeks or months. Tracking them helps providers find the hosts taking part.
What providers cover, and what they leave to you
This figure measures the share of observed attacks where providers applied mitigation. It edged up slightly from a year earlier. Netscout's figure does not say how the remaining attacks were handled.
Netscout says provider controls often focus on shared infrastructure. Customers get protection through separate DDoS services. Hardik Modi of Netscout's ASERT team calls traditional coarse network controls "insufficient". He asks for finer, more selective filtering and more scrubbing capacity at network edges.
Questions to put to your team
First, how do we test resilience? A test that counts only gigabits per second misses the packet, connection and request rates that tax firewalls and load balancers.
Second, does our internet provider's protection cover us, or only its shared network? If we rely on a dedicated DDoS service, who bought it, and when was it last tested?
Third, would we notice a carpet-bombing attack that keeps each address under its alert threshold? Fourth, can our response start inside a one-minute attack, or does it assume a longer one?
Finally, what happens to us if another customer of our provider is the target? Netscout reports that a failed router component can cut off unrelated customers. The answer belongs in the continuity plan, not only the security plan.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Help Net Security.
