Cloudflare DDoS Threat Report 2026 Q3, published October 29, 2026, covering July to September 2026
8,226 DDoS Attacks an Hour: Cloudflare Q3 Shows Swarms of Small Attacks Replacing the Giants
Cloudflare Cloudforce One reported that it autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026, about 8,226 network-layer attacks per hour, or one every 0.44 seconds, with mitigated traffic totaling 272.6 petabytes at the network layer. The network-layer count is up 208 percent from the same quarter in 2025, and the shape of the attacks changed more than the volume: 96 percent ended in under 10 minutes and 98 percent stayed under 1 Gbps, a profile Cloudflare identifies as the signature of DDoS-for-hire booter services, while noting that under 1 Gbps is still more than enough to overwhelm a server or website. At the other end of the scale, hyper-volumetric attacks above 1 Tbps fell 69 percent quarter over quarter, from 805 in Q2 to 251 in Q3, coinciding with early 2026 law enforcement action that dismantled four large IoT botnets, Aisuru, KimWolf, JackSkid, and Mossad, though new variants such as Dysphoria and Evooo1Bot continue to appear and Mirai-classified traffic still made up 46.5 percent of mitigated network-layer bytes, including a sustained 49.7-hour attack in August. Attack vectors rotated sharply: CLDAP floods collapsed 99.5 percent to 0.05 percent of attacks after surging in the first half, DNS amplification rose 215 percent to 3.43 percent, and general UDP floods climbed from 14.06 percent to 31.31 percent. The United States was the most-attacked location, followed by China and Indonesia, and Media, Production and Publishing remained the most-attacked industry while its share fell to roughly a quarter of its Q2 level as targeting spread across more industries. All figures describe attacks Cloudflare network observed and mitigated, not a census of attacks across the whole internet.
Executives
The headline is not the record size, it is the frequency: attacks now arrive as constant short bursts that each last minutes, which means availability protection has to be automatic and always on, not a service a team activates after noticing an outage. The encouraging half is measurable too: the largest attacks fell by more than two thirds after coordinated botnet takedowns, evidence that enforcement against the hiring market and the botnets behind it changes the numbers your business sees.
CIO / CISO
Test your posture against the actual Q3 profile: a sub-1 Gbps burst lasting under 10 minutes, repeated for hire, plus DNS amplification and UDP floods as the rising vectors. That means confirming always-on mitigation is in front of every public property, that rate limiting and upstream filtering cover UDP and DNS reflection patterns, and that your own DNS infrastructure is not an open reflector contributing to the 215 percent amplification rise. Measure detection-to-mitigation in seconds in your next exercise, because a 10-minute attack is over before a manual escalation finishes.
Engineers
Close the reflector side as well as the target side: audit for open DNS resolvers and any exposed CLDAP or UDP services that can be abused for amplification, since the vector rotation this quarter shows attackers moving to whichever reflection source stays open. For defense, pre-stage the runbook for short bursts, automatic triggers, provider contacts, and status communication, and review August-style endurance too, because the same quarter contained a 49.7-hour Mirai attack alongside the swarms.
Everyone (non-IT)
If a site you use stutters or drops for a few minutes and then recovers, a short DDoS burst is a plausible cause, and it is usually aimed at the service, not at you or your account. No action is needed beyond waiting and avoiding repeated password or payment submissions while a service is mid-incident.