Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants - Cloudflare Blog
Cloudflare mitigated 18.2 million network-layer DDoS attacks in Q3 2026, with short-burst attacks surging 208% while hyper-volumetric attacks dropped 69%.
Cloudflare's latest DDoS Threat Report reveals a significant shift in attack patterns during Q3 2026, with the company autonomously mitigating 18.2 million network-layer attacks and 14.4 trillion HTTP requests. This translates to approximately 8,226 attacks per hour, or one attack every 0.44 seconds, totaling 272.6 PB of mitigated traffic at the network layer.
Swarms replace giants
The most notable trend was the surge in short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps, which increased by 208%. These attacks, characteristic of DDoS-for-hire 'booter' services, primarily targeted computer software, gambling, and IT industries. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by 69%, likely due to law enforcement actions against four major IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad.
However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure.
Tactical shifts
Attackers dramatically changed their reflection and amplification tactics, abandoning CLDAP floods which collapsed by 99.5%. Instead, they pivoted toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods. DNS amplification now accounts for 3.43% of all network-layer attacks, exploiting open DNS resolvers in a reflection-and-amplification pattern.
Broadening targets
Attack targets expanded significantly across industries and geographies. The United States reclaimed the most-attacked position from China, while Canada jumped 10 spots to #6 and Israel moved up 7 places to #10, both experiencing spikes amid geopolitical tensions and domestic events. Media organizations remained the most-attacked industry but at roughly a quarter of Q2 levels, with Internet, Consumer Services, and Adult Entertainment climbing into the top 10.
Despite the surge in attacks, Cloudflare's network absorbed the threat with its 330+ cities providing free, unmetered DDoS protection backed by 500 Tbps of capacity. The company's autonomous systems detect and mitigate attacks without human intervention, crucial given that most attacks end before analysts could respond.
Related
