November 2025 recorded a total of 1,067 DDoS attacks on the DigiCert UltraDDoS Protect platform, reflecting a 15.65% decline from October. Despite the reduction in volume, the month was characterized by a notable rise in higher-intensity activity. The largest observed attack reached 709.55 Gbps with more than 61 million packets per second, demonstrating the continued ability of malicious actors to generate significant operational pressure. While more than half of all events remained under 0.5 Gbps, the presence of several large-scale attacks underscores an ongoing trend toward targeted, high-impact disruption. Month-over-month analysis reveals a meaningful shift in attack composition. Lower-bandwidth incidents decreased sharply, while the upper tiers expanded considerably, including a 400% increase in the 50–100 Gbps category and an 80% rise in attacks exceeding 100 Gbps. Packet-rate data reflects this same escalation, with substantial increases in mid to high PPS tiers such as 400–500K, 500K–1M, and multi-million PPS ranges. These changes indicate a growing preference among malicious actors for concentrated, high-capacity bursts designed to apply rapid and sustained pressure on network infrastructure.
Observed DDoS vectors in November 2025 were dominated by the Total Traffic category, which accounted for 58.23% of all events and reflects attacks where inbound traffic exceeded established thresholds, creating notable operational pressure without relying on a specific protocol signature. High-volume UDP activity was the second most prevalent vector at 20.03%, highlighting its continued use in large-scale flooding. DNS amplification and several TCP-based methods—including SYN, RST, and SYN/ACK amplification—also remained consistently active, supported by smaller reflection and amplification techniques. Collectively, these patterns show that malicious actors relied on a blend of volumetric and protocol-specific methods, with November demonstrating a clear concentration of threshold-exceeding events augmented by diverse secondary vectors. Carpet-bombing activity declined sharply month-over-month, dropping 72.90% and accounting for 6.65% of November’s events. While reduced, these attacks remain operationally noteworthy due to their distributed nature and potential to overload mitigation systems.
Overcall, November 2025 highlights an increasingly concentrated and high-intensity DDoS environment, where fewer but more forceful attacks are becoming the norm. The rise in large-scale bandwidth and packet-rate events, paired with the continued use of multi-vector techniques, underscores an adversary community that is refining its methods to maximize operational disruption. These patterns point to a threat landscape that is evolving in sophistication and impact, emphasizing the importance of ongoing visibility into attack behavior and the strategic insights drawn from month-to-month analysis.
Stats at a Glance
- Total Number of Attacks: 1,067
- Total number of hours of downtime avoided: ~ 585.29 (a 19.92% increase compared to October 2025)
- Number of Mega Attacks (100+ Gbps): 9 (a 80% increase compared to October 2025)
- Largest DDoS Attack (Gbps): 709.56 Gbps (a 49.01% increase compared to October 2025)
- Largest DDoS Attack (million packets-per-second): 126.54 Mpps (a 212.52% increase compared to October 2025)
- Longest DDoS Attack: 2.39 Days (a 94.99% increase compared to October 2025)
- Average DDoS Attack (Gbps): 5.44 Gbps (a 118.47% increase compared to October 2025)
- Median DDoS Attacks (Gbps): 0.49 Gbps
- Average DDoS Attack (packets-per-second): 917.33 Kpps (a 225.47% increase compared to October 2025)
- Median DDoS Attack (packets –per second): 75.88 Kpps
- Average Duration: 32.91 Minutes (a 40.94% increase compared to October 2025)
- Median Duration: 7.34 Minutes
- Unique vs Carpet Bombing: 93.35% Unique / 6.65% Carpet Bombing
- Top Three Industry Targeted: IT/Technical Services (35.71%), Financial Services (24.26%), Health Care (13.14%)
