Cloudflare’s latest Project Galileo data reinforces a growing reality: civil society organizations are now operating under near-constant digital assault.
Between February 2025 and January 2026, they blocked 38.5 billion malicious requests targeting organizations protected under the program, averaging more than 105 million attacks per day. The findings also show that civil society websites face cyberattack rates over 7 times higher than typical internet properties, highlighting how disproportionately exposed these groups have become in the broader threat landscape.
At the center of this pressure are journalists and independent media outlets, which continue to represent the most heavily targeted category under Project Galileo protection. Across the reporting period, they absorbed the majority of attack volume, driven largely by large-scale DDoS campaigns that flood sites with traffic until services degrade or collapse.
The nature of these attacks is less about exploiting software flaws and more about overwhelming infrastructure. DDoS-style traffic dominates the landscape, often delivered in sudden spikes tied to political events, investigative reporting cycles, or regional instability. This makes resilience a core requirement rather than an optional layer of defense.
Human rights organizations and civil society groups form the second most targeted segment. These organizations routinely experience sustained campaigns that combine high-volume request floods with lower-level probing traffic designed to test system limits over time. In multiple documented cases, attack intensity has reached hundreds of millions of requests within hours or days, often spread across coordinated bursts rather than a single continuous surge.
One of the clearest patterns in the report is the scale differential between attack types. While traditional web application threats like SQL injection or vulnerability scanning still exist, they are significantly overshadowed by raw traffic-based disruption. In civil society workloads, DDoS traffic accounts for the vast majority of mitigated activity, frequently exceeding 90% of total attack volume in media-focused segments.
Geographically and politically sensitive regions remain consistent hotspots. Investigative journalism outlets in regions such as Eastern Europe and the Middle East, along with NGOs focused on human rights accountability, continue to experience the most sustained pressure. These attacks are often aligned with real-world events, suggesting a reactive and sometimes politically motivated targeting pattern.
TL;DR
- 38.5 billion malicious requests blocked between Feb 2025 to Jan 2026
- ~105 million attacks per day on average
- Civil society faces ~7× higher attack rates than typical websites
- Journalists and media remain the most targeted group by volume
- Attack patterns dominated by DDoS traffic (>90% in media segments)
- Peak incidents reached hundreds of millions to billions of requests in short bursts (varies by campaign)
- Multi-day sustained attacks are increasingly common, often combining high-intensity spikes, long-duration low-volume pressure campaigns
