Only 2% of network-layer DDoS attacks extend beyond ten minutes.

Government’s share of total attacks increased from 5% to 12% year-over-year, with an average attack size of 5.5 Gbps.

The number of documented DDoS attacks in the Link11 network rose by 75% in 2025, after a 137% increase the previous year.

Manufacturing experienced an average attack size of 11.6 Gbps, the largest across all industries.

Education accounted for 24% of total DDoS attacks in 2025, up from 15% the prior year, with more than 45% of attacks occurring in April and May during peak academic periods.

Telecoms accounts for just 24% DDoS attacks in 2025, down from 42% in 2024.

89% of DDoS attacks now conclude in under 10 minutes.

A coordinated series of DDoS attacks totaled 509 terabytes of data in 2025.

The average DDoS attack size increased almost 70% from the year prior.

The average DDoS attack duration decreased to 20 minutes, down from 39 minutes the previous year.

On average, 2.8 follow-up DDoS attacks occured after an initial incident, an 80% increase compared to the previous year.

There is greater than a 70% probability that an initial DDoS attack is followed by at least one additional attack.

Active DDoS attacks were observed 88% of the time, equating to 322 days per year when systems in the Link11 network are targeted.

Three DDoS attacks surpassed 1 Tbit/s in 2025.

The strongest DDoS attack measured 1.33 Tbit/s and exceeded 120 million packets per second.

The longest recorded DDoS attack lasted 12,388 minutes (over eight days) in the Link11 network.

75% of organizations are concerned about Distributed Denial-of-Service (DDoS) attacks targeting AI agents.

Colombia was the most targeted country by DDoS attacks with over 20 victims, followed by Venezuela and Brazil, in 2025.

APAC's Web DDoS attacks surged 485% year over year.

94.4% of Web DDoS attacks measured under 100,000 requests per second.