NewOne plan from €9.90, extra domains €1, every feature included

Back to home

Open data

Live DDoS attack statistics from our own network.

These are measurements, not estimates: every figure below is counted by the Akarguard edge as attacks happen, starting September 13, 2026. Updated hourly and free to cite.

Attacks mitigated

1,525

since we started measuring

Last 30 days

1,074

attacks detected

Peak attack rate

512,041/s

highest filtered request rate seen

Requests filtered

1,863,256,517

malicious requests dropped during attacks

Median attack length

20 s

start to resolution

Total requests seen

2,145,235,796

all traffic across the edge

Attacks by type

Automated traffic733 · 48%
HTTP flood387 · 25%
Request flood242 · 16%
Elevated filtering104 · 7%
Network flood59 · 4%

Attacks by severity

critical691 · 45%
low632 · 41%
medium125 · 8%
high77 · 5%

Last updated 2026-11-02 22:42 UTC.

How the protection works

Akarguard runs its own edge in front of your site. Every request passes through layers that get progressively cheaper to say no with, so an attack is stopped as early — and as inexpensively — as possible:

  1. TLS fingerprinting (JA3/JA4).We identify each client by the shape of its TLS handshake, not by the User-Agent header it claims. A bot that pretends to be Chrome still carries its real tool's fingerprint, so it gives itself away.
  2. Kernel-level drop. Sources that keep flooding are dropped in the kernel with an ipset/iptables rule — their packets die before they ever cost a TLS handshake, which is what keeps the edge fast under load.
  3. Rate limits & geo / ASN / IP rules. Per-source ceilings plus per-country, per-network and per-address allow/block rules you control from the panel.
  4. Automatic browser challenge.When a domain comes under attack we turn on a lightweight “checking your browser” step automatically. Real browsers clear it once and are remembered; automated floods can't, so they never reach your server. It switches off on its own when the attack ends.
  5. Web application firewall. SQL injection, XSS and path-traversal attempts are filtered at the edge before they reach your app.
  6. Clean traffic is served. Whatever passes is proxied to your origin — cached and compressed where enabled — so real visitors are unaffected.

Because bad traffic is dropped at the edge, your origin only ever sees the clean remainder. In our own measurements a distributed flood peaking at over 200,000 requests per second was filtered at roughly 98% at the edge with the origin left untouched.

Methodology

Every figure comes from counters on the Akarguard edge, sampled every ten seconds and written to per-minute records. An attack is recorded when filtered traffic to a domain rises above both an absolute threshold and its own rolling baseline, and it is closed after ninety seconds below those thresholds.

What these numbers are not: they are not an industry estimate or a survey. They describe the traffic that reached one network, so they under-report attacks aimed at targets we do not protect, and the mix reflects the sites we serve. We publish the start date above so the coverage is never overstated.

Privacy: the data is aggregated across all protected domains. No customer, domain, visitor or IP address appears anywhere on this page or in the JSON feed behind it.

Use this data

Published under CC BY 4.0: quote it, chart it, or build on it for any purpose, including commercially. The only condition is attribution — credit Akarguard and link to this page.

Machine-readable

The same figures as JSON, updated continuously:

https://dash.akarguard.net/api/public/stats

Questions about the data, or want a breakdown for a story? security@akarguard.net

Keep your site up
on its worst day.

€9.90 a month, €1 for each extra domain, every feature included, 7 days free. One DNS change to start.

Start Free TrialContact Us