Distributed denial-of-service (DDoS) attacks continue to pose a major threat to internet infrastructure, online services and businesses. Cloudflare's latest threat intelligence report reveals that it mitigated 18.2 million network-layer DDoS attacks during the third quarter of 2026, representing a 38% increase compared with the previous quarter.
The report, published on October 29, 2026, also recorded 14.4 trillion HTTP DDoS requests during the same period. The findings highlight a changing threat landscape in which attackers are increasingly relying on automated, short-duration attacks, while traditional large-scale volumetric attacks remain a significant concern.
18.2 Million Network-Layer Attacks in Three Months
According to Cloudflare, its global network autonomously mitigated 18.2 million Layer 3 DDoS attacks between July and September 2026. This represents a substantial rise from 13.2 million attacks in Q2 2026 and 10 million in Q1 2026.
On average, the company handled approximately:
- 8,226 network-layer attacks every hour
- 197,400 attacks every day
- One network-layer attack approximately every 0.44 seconds
- 14.4 trillion HTTP DDoS requests during the quarter
These figures demonstrate the scale at which modern DDoS campaigns operate. The numbers represent attacks mitigated by Cloudflare across its network, rather than a count of all DDoS activity worldwide.
Short-Burst DDoS Attacks Surge by 208%
One of the most notable findings in the report is the sharp increase in short-burst, low-bandwidth attacks. These attacks, which last less than 10 minutes and remain below 1 Gbps, increased by 208% compared with the same quarter in 2025.
Cloudflare reported that 96% of these attacks ended within 10 minutes, while 98% remained below 1 Gbps.
Although these attacks may appear relatively small compared with multi-terabit floods, they can still disrupt services. A short traffic spike can overwhelm an application, exhaust connection limits, consume server resources or affect an unprotected network endpoint.
The growing popularity of DDoS-for-hire services, commonly known as booters or stressers, is one factor behind this trend. Such services allow customers to launch traffic floods without building or managing their own botnet infrastructure.
Why Are Attackers Moving Towards Smaller, Frequent Attacks?
Large volumetric attacks are designed to overwhelm network capacity with enormous amounts of traffic. However, smaller and more frequent attacks can offer attackers a different advantage: they can be launched repeatedly, are relatively inexpensive to initiate and may be harder for teams to investigate when each event is brief.
These attacks can also create operational pressure. Security teams must distinguish malicious traffic from legitimate demand, investigate repeated alerts and maintain availability while attacks continue to appear.
For organizations, this means that DDoS readiness cannot focus only on defending against record-breaking traffic volumes. Detection, automated mitigation and application-level resilience are equally important.
Attacks Exceeding 1 Tbps Decline by Nearly 69%
While the overall number of network-layer attacks increased, Cloudflare observed a significant decline in hyper-volumetric attacks exceeding 1 terabit per second (Tbps).
The number of such attacks fell from 805 in Q2 2026 to 251 in Q3, a decrease of nearly 69%.
Cloudflare suggested that law enforcement actions against major IoT botnets earlier in 2026 may have contributed to this decline. The operations targeted botnets including AISURU, KimWolf, JackSkid and Mossad.
However, the decline does not mean that the botnet threat has disappeared. Cloudflare highlighted the emergence of new variants, including Dysphoria and Evooo1Bot, showing that the ecosystem continues to evolve.
DNS Amplification Attacks Increase by 215%
Cloudflare also reported a major shift in the network protocols being abused by attackers. DNS amplification attacks increased by 215% during Q3 and accounted for 3.43% of network-layer DDoS attacks.
DNS amplification is a reflection-based attack. An attacker sends DNS queries to publicly accessible resolvers while spoofing the victim's IP address. The resolvers then send their responses to the victim instead of the attacker. Because responses can be significantly larger than the original requests, attackers can amplify the volume of traffic directed at a target.
Another notable development was the increase in general UDP floods. These attacks accounted for 31.31% of network-layer attacks, up from 14.06% in the previous quarter.
In contrast, CLDAP amplification attacks declined sharply, accounting for just 0.05% of network-layer attacks in Q3. This shift illustrates how attackers can rapidly change their preferred reflection and amplification techniques.
Which Industries Were Most Targeted?
The report identified several industries that experienced significant DDoS activity during Q3 2026. These included:
- Media, production and publishing
- Information technology and services
- Gambling and casinos
- Computer software
- Telecommunications providers
Cloudflare also observed a broader distribution of attacks across industries, with internet infrastructure and consumer services becoming more prominent targets.
These sectors depend heavily on online availability. Even a temporary outage can interrupt customer access, business operations, digital transactions and essential services.
United States, China and Indonesia Among the Most Attacked Locations
Cloudflare's Q3 data placed the United States at the top of the list of most-attacked locations, followed by China and Indonesia. The United Kingdom and Türkiye also featured among the leading targets.
Canada and Israel entered the top 10 during the quarter. Canada's rise was associated with attacks against retail, telecommunications, service providers and marketing businesses. Israel also experienced a notable increase in DDoS activity during September.
Geographic rankings can change from quarter to quarter as attackers shift their targets in response to geopolitical events, business interests and opportunities to disrupt online services.
What Does This Mean for Cloud and DevOps Teams?
The latest findings offer important lessons for organizations operating internet-facing applications, cloud infrastructure and distributed services. DDoS protection should be treated as an essential part of infrastructure design rather than an emergency measure added after an attack.
1. Deploy DDoS Protection at the Network Edge
Organizations should use network-edge protection services that can absorb and filter malicious traffic before it reaches their origin infrastructure. A distributed mitigation network can help reduce the impact of large traffic floods and protect the availability of public-facing services.
2. Protect the Origin Server
Using a CDN or reverse proxy alone does not automatically secure an origin server. Teams should restrict direct public access wherever possible, allow traffic only from trusted proxy or protection networks and use appropriate firewall rules. Otherwise, attackers may bypass the edge layer and target the origin directly.
3. Apply Rate Limiting and Traffic Filtering
Rate limiting, connection controls, bot detection and protocol-aware filtering can help reduce the impact of repeated requests and suspicious traffic patterns. Rules should be designed carefully to avoid blocking legitimate users during sudden traffic spikes.
4. Monitor Network and Application Metrics
Infrastructure teams should monitor bandwidth consumption, packet rates, connection counts, request rates, error rates and latency. Combining network-level telemetry with application logs can help teams identify whether an incident is a volumetric flood, an application-layer attack or a legitimate traffic surge.
5. Automate Detection and Incident Response
Because many attacks last only a few minutes, manual response may be too slow. Automated alerts, mitigation policies and tested incident-response procedures can help security teams respond consistently. Teams should also document escalation paths and define how to communicate during availability incidents.
6. Build Resilience into Cloud Architecture
Load balancing, autoscaling, multi-zone deployments and resilient DNS configurations can improve service availability. However, autoscaling alone is not a DDoS defence: uncontrolled scaling can increase infrastructure costs without stopping malicious traffic. It should be combined with filtering and upstream mitigation.
Why DDoS Protection Is Becoming More Important
The Q3 2026 report shows that the DDoS threat is not simply growing in size; it is becoming more varied. Organizations face a combination of short, frequent attacks, protocol-based floods, amplification techniques and large volumetric events.
For businesses that rely on cloud platforms and internet-facing services, availability is directly connected to customer trust and operational continuity. A successful DDoS attack can affect websites, APIs, DNS services, online transactions and other critical systems.
As attackers continue to automate their operations and change techniques, organizations need layered protection that combines network filtering, application security, continuous monitoring and tested response processes.
Conclusion
Cloudflare's Q3 2026 DDoS Threat Report highlights the scale and changing nature of distributed denial-of-service attacks. With 18.2 million network-layer attacks mitigated in one quarter, a 208% rise in short-burst attacks and a 215% increase in DNS amplification, the findings show why organizations must prepare for more than just massive traffic floods.
The decline in attacks exceeding 1 Tbps is encouraging, but the emergence of new botnet variants and the growth of smaller, frequent attacks demonstrate that the threat remains active. For cloud and DevOps teams, the priority should be to build resilient infrastructure, secure origin systems, automate mitigation and continuously monitor network behaviour.
Frequently Asked Questions
How many DDoS attacks did Cloudflare mitigate in Q3 2026?
Cloudflare reported mitigating 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests between July and September 2026.
How much did network-layer DDoS attacks increase?
The number of network-layer attacks increased by approximately 38% compared with Q2 2026, rising from 13.2 million to 18.2 million.
What are short-burst DDoS attacks?
Short-burst DDoS attacks are brief traffic floods, often lasting less than 10 minutes. Despite their short duration and relatively low bandwidth, they can disrupt servers, applications and network services.
What is DNS amplification?
DNS amplification is a reflection-based DDoS technique in which attackers use spoofed DNS queries to make open resolvers send amplified responses to a victim's IP address.
Why did attacks exceeding 1 Tbps decline?
Cloudflare reported a nearly 69% quarter-over-quarter decline in attacks exceeding 1 Tbps. The company suggested that law enforcement actions against major IoT botnets earlier in 2026 may have contributed to the reduction.
How can organizations protect themselves from DDoS attacks?
Organizations can strengthen DDoS resilience through upstream mitigation, CDN and edge protection, origin access restrictions, rate limiting, traffic monitoring, automated response and resilient cloud architecture.