Cloudflare DDoS Report Q3 2026: More Swarms, Fewer Giants

Cloudflare's Q3 2026 DDoS Threat Report says the network mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests, about 8,226 per hour. The quarter brought a surge in short-burst attacks, a collapse in CLDAP floods, and a shift in top targets and attacked locations.

Short bursts rise as giants fall

Short-burst attacks lasting under 10 minutes and under 1 Gbps surged 208% compared with Q3 2025. Cloudflare said 96% of network-layer attacks ended in under 10 minutes and 98% stayed under 1 Gbps. These attacks were tied to DDoS-for-hire booter services and mainly targeted computer software, gambling and casinos, and information technology industries. Hyper-volumetric attacks above 1 Tbps fell to 251 in Q3 from 805 in Q2, coinciding with law enforcement action against four IoT botnets named Aisuru, KimWolf, JackSkid, and Mossad. New variants such as Dysphoria and Evooo1Bot show IoT botnets remain a durable threat. Mirai-classified mitigation peaked in August at 57.23 PB, or 46.5% of mitigated network-layer bytes, with four days above three petabytes and one sustained attack lasting 49.7 hours.

Vectors and targets shift

CLDAP floods collapsed by 99.5% quarter over quarter after a 580% surge in the first half of 2026, falling to 0.05% of attacks. DNS amplification rose 215% to 3.43% of network-layer attacks, while other UDP floods climbed from 14.06% to 31.31%. Media, Production and Publishing remained the most-attacked industry, though its share fell to roughly a quarter of its Q2 level. Internet rose to sixth place, while Consumer Services reached eighth and Adult Entertainment ninth. The United States was the most-attacked location, followed by China, with Indonesia third at 2.93%. Canada jumped from 16th to sixth, and Israel moved up seven spots to tenth after sustained activity in mid-September.

Cloudflare response

Cloudflare says every service on its network has free, unmetered DDoS protection across more than 330 cities, backed by 500 Tbps of capacity. Its systems detect and mitigate attacks without human intervention. More than 800 networks use its free DDoS Botnet Threat Feed for service providers. Cloudforce One draws on telemetry from a network protecting more than 20% of the web.

Sources: Cloudflare