Cloudflare’s DDoS report for Q3 2026 reveals that the company mitigated 18.2 million network-layer attacks, a 38% increase from the previous quarter, as attackers increasingly relied on short, frequent bursts rather than only massive traffic floods.
Published on October 29, 2026, the report shows approximately 8,226 network-layer DDoS attacks every hour across Cloudflare’s infrastructure. That’s roughly one attack every 0.44 seconds.
Cloudflare also mitigated 14.4 trillion malicious HTTP requests associated with application-layer DDoS activity during the quarter.
While attacks exceeding 1 terabit per second declined by nearly 69%, shorter and lower-bandwidth attacks remained a major concern. This shift creates a different challenge for businesses: repeated disruptions can occur without traffic reaching record-breaking volumes.
The biggest concern is speed. Most attacks ended within 10 minutes, making continuous detection and automated mitigation increasingly important for websites, APIs, hosting providers, and other internet-facing services.
For practical ways to strengthen business websites and online infrastructure, explore our Small Business Cybersecurity Defense Hub.
Key Findings From Cloudflare’s Q3 2026 DDoS Report
- 18.2 million network-layer DDoS attacks were mitigated during July–September 2026.
- 38% quarterly growth: Attack counts increased from 13.2 million in Q2 to 18.2 million in Q3.
- 14.4 trillion HTTP DDoS requests were mitigated at the application layer.
- Short-burst attacks: Cloudflare reported a significant rise in short, low-bandwidth attack activity.
- 69% decline in attacks above 1 Tbps: The count fell from 805 in Q2 to 251 in Q3.
- 215% increase in DNS amplification: Attackers made greater use of reflection and amplification techniques.
- Targeted industries: Media, publishing, IT services, software, telecommunications, and gambling faced substantial attack activity.
Cloudflare Blocked 18.2 Million Network-Layer DDoS Attacks
A distributed denial-of-service attack attempts to overwhelm websites, applications, networks, or online services with traffic until legitimate users experience slow responses or cannot access them.
Unlike a conventional intrusion, a DDoS attack does not necessarily involve stealing passwords or exploiting application vulnerabilities.
Instead, attackers attempt to exhaust bandwidth, network connections, server resources, or application-processing capacity.
Cloudflare’s report shows a continuing increase in network-layer attack counts throughout the first three quarters of 2026.
| Quarter | Network-Layer DDoS Attacks |
|---|---|
| Q1 2026 | 10.0 million |
| Q2 2026 | 13.2 million |
| Q3 2026 | 18.2 million |
That represents a 38% increase between Q2 and Q3. Compared with the corresponding quarter in 2025, Cloudflare reported a much larger year-over-year increase in network-layer attack volume.
These comparisons describe different periods and should not be confused.
The report also records hundreds of petabytes of mitigated traffic across Cloudflare’s network and application protection systems.
Important: These figures represent attacks and traffic observed through Cloudflare’s infrastructure. They are not a count of every DDoS attack across the internet.
Why Short DDoS Attacks Are Becoming a Bigger Problem
The most important change is not simply the growing number of attacks. Their duration and traffic patterns are also changing.
Cloudflare reported that 96% of network-layer DDoS attacks lasted less than 10 minutes, while 98% remained below 1 Gbps.
These relatively small attacks can still disrupt websites running on limited bandwidth, undersized servers, or infrastructure without sufficient upstream protection.
A small website does not need to face a terabit-scale attack to become unavailable.
Even repeated bursts of lower-volume malicious traffic may exhaust connection limits or overwhelm application resources.
Why Manual Incident Response Is Often Too Slow
Imagine a website suddenly receiving an abnormal amount of traffic.
Its monitoring system detects the issue after several minutes. The operations team then investigates, contacts the hosting provider, and begins applying mitigation measures.
By that time, a short DDoS burst may already have ended.
The attacker can repeat the process later or shift the traffic to another endpoint.
This makes short attacks difficult for organizations relying entirely on manual intervention.
Cloudflare’s research also discusses DDoS-for-hire services, often called booters or stressers, which make attack infrastructure accessible to people without advanced networking skills.
For defenders, the lesson is straightforward: automated traffic analysis and always-on protection are increasingly important.
Attacks Above 1 Tbps Dropped Nearly 69%
Not every DDoS metric increased during the quarter.
Cloudflare recorded 805 attacks exceeding 1 terabit per second in Q2 2026. That number declined to 251 in Q3.
The reduction is approximately 69%, indicating fewer of the largest network floods during the reporting period.
Cloudflare noted that the decline followed law-enforcement activity against major IoT botnets, including AISURU, KimWolf, JackSkid, and Mossad.
However, that timing alone does not prove that enforcement actions were the only reason for the decline.
Fewer extreme attacks does not mean the overall DDoS threat has disappeared.
In fact, total network-layer attack counts increased sharply during the same period.
This demonstrates why businesses should prepare for both massive bandwidth floods and smaller attacks that occur repeatedly.
IoT Botnets Continue to Drive DDoS Activity
Cloudflare’s report also highlighted emerging IoT botnet variants, including Dysphoria and Evooo1Bot.
Internet of Things devices can become attractive botnet targets when they use weak credentials, outdated software, or exposed management interfaces.
After compromising such devices, attackers may connect them to command-and-control infrastructure and instruct them to generate traffic against selected targets.
Botnets can combine large numbers of infected devices, allowing traffic to originate from many different networks.
This distributed structure makes blocking malicious activity more complicated than stopping traffic from a single server.
Cloudflare identified substantial Mirai-classified traffic during Q3, including 57.23 petabytes of mitigated traffic in August.
The report also described a sustained Mirai attack lasting approximately 49.7 hours between August 19 and August 21.
These observations illustrate an important difference: although most recorded attacks are short, some botnet operations still generate prolonged traffic floods.
DNS Amplification Attacks Increased 215%
Attackers also changed the protocols used to generate malicious traffic.
Cloudflare observed a 215% quarterly increase in DNS amplification attacks.
At the same time, general UDP floods became more prominent, while attacks involving certain other protocols declined.
How DNS Amplification Works
DNS amplification attacks abuse DNS servers capable of generating responses larger than the original requests.
In networks where source-address spoofing is possible, attackers can make a DNS server send its response toward a victim rather than the attacker’s own system.
Repeated across many servers, the resulting traffic can consume significant bandwidth and disrupt services.
Reflection and amplification attacks are particularly concerning because the targeted organization may receive traffic from otherwise legitimate infrastructure.
This does not mean that every DNS server is vulnerable.
The main defensive priorities are preventing unnecessary open recursion, using appropriate rate limits, securing exposed services, and implementing anti-spoofing practices.
Which Industries Faced the Most DDoS Attacks?
Cloudflare identified media, production, and publishing among the most-targeted industries during Q3 2026.
Other heavily targeted sectors included information technology, computer software, gambling, casinos, and telecommunications.
The findings show that attackers target both high-profile organizations and businesses whose operations depend on continuous online availability.
| Industry | Potential Business Impact |
|---|---|
| Media and publishing | Website outages and disrupted content delivery |
| IT and software services | Unavailable applications, APIs, and customer portals |
| Telecommunications | Network and connectivity disruptions |
| Gambling and casinos | Interrupted customer sessions and online services |
| Consumer services | Failed transactions and inaccessible websites |
These are possible operational consequences, not evidence that every organization included in the dataset suffered a successful outage.
United States, China, and Indonesia Among Most-Targeted Locations
The United States ranked as the most-attacked location in Cloudflare’s Q3 dataset, followed by China.
Indonesia moved into the top three, while the United Kingdom and Türkiye also appeared among the most frequently targeted locations.
Canada rose in the rankings, with attacks affecting sectors including retail, telecommunications, service providers, and marketing.
Israel also entered the top ten following increased attack activity during September.
Important distinction: These rankings describe where Cloudflare observed attacks being directed. They do not establish the nationality or physical location of the attackers.
How Businesses Can Protect Against Modern DDoS Attacks
Cloudflare’s latest findings show why organizations need defenses capable of handling both frequent short bursts and high-volume network floods.
1. Enable Always-On DDoS Protection
Use suitable network-layer or CDN-based protection that can detect abnormal traffic and respond automatically.
Relying only on manually blocking IP addresses after an outage has started is unlikely to provide sufficient protection against short attacks.
2. Monitor Traffic at Short Intervals
Track request rates, bandwidth spikes, connection failures, origin response times, and application availability.
Monitoring systems should be capable of identifying brief anomalies rather than averaging them away over longer reporting intervals.
3. Protect Origin Servers
Where appropriate, restrict direct access to web application origins so attackers cannot easily bypass upstream protection.
Review cloud security groups, network firewalls, load balancer configurations, and exposed public IP addresses.
4. Harden DNS and UDP Infrastructure
Avoid exposing unnecessary reflection-capable services.
Review DNS recursion settings, implement suitable response-rate controls, and follow network anti-spoofing practices.
5. Prepare an Incident Response Plan
Document how administrators should contact their hosting provider, ISP, cloud platform, and DDoS protection vendor during an attack.
Test recovery and failover procedures before a real incident occurs.
6. Protect APIs and Critical Application Endpoints
Security planning should cover more than the website homepage.
Authentication endpoints, APIs, customer dashboards, and payment services may all be critical to business operations.
Evaluate their resilience using authorized testing in controlled environments.
Cloudflare DDoS Report: Confirmed vs Unknown
Confirmed by Cloudflare
- 18.2 million network-layer DDoS attacks were mitigated in Q3 2026.
- Network-layer attack counts increased approximately 38% from Q2.
- 14.4 trillion HTTP DDoS requests were mitigated.
- 96% of network-layer attacks lasted less than 10 minutes.
- 98% remained below 1 Gbps.
- Attacks exceeding 1 Tbps declined from 805 to 251.
- DNS amplification attacks increased 215% quarter over quarter.
- IoT botnet activity continued, including newly identified variants.
Not Established by the Report
- That 18.2 million separate organizations were attacked.
- That 14.4 trillion individual HTTP DDoS attacks occurred.
- That every detected attack resulted in a successful outage.
- That law-enforcement operations were solely responsible for the decline in extreme attacks.
- That every DDoS attack worldwide was visible to Cloudflare.
- That the most-targeted countries were necessarily the countries launching the attacks.
CyberUpdates365 Analysis: Why Attack Frequency Matters More Than Ever
The most important lesson from Cloudflare’s Q3 2026 report is that DDoS risk cannot be measured by peak bandwidth alone.
Massive terabit-scale attacks attract attention, but repeated lower-bandwidth floods can also disrupt businesses that depend on continuously available websites, payment systems, and APIs.
For DevOps and infrastructure teams, this changes the monitoring conversation.
Instead of asking only whether a network can survive a large traffic spike, organizations should also ask whether their monitoring and protection systems can detect a 30-second burst before customers experience failures.
That requires short-interval metrics, automated mitigation, tested upstream protection, and visibility into the behavior of individual services.
Smaller businesses may be particularly exposed when they depend on a single application server, limited hosting bandwidth, or infrastructure without adequate network-level defenses.
The report also demonstrates why attack statistics must be interpreted carefully.
A 69% decline in extreme floods can occur alongside a 38% quarterly increase in overall network-layer attack counts.
Neither trend cancels the other.
Organizations should prepare for both sustained large-scale attacks and repeated short disruptions.
The takeaway: DDoS defense in 2026 increasingly depends on detecting and stopping attacks automatically, rather than simply surviving the largest possible flood.
Cloudflare’s infrastructure security challenges extend beyond DDoS protection. Separate research demonstrated a Cloudflare Workers Spectre side-channel attack involving cross-tenant information leakage. Although unrelated to DDoS, the findings highlight another security concern for shared cloud environments.
Research Evidence
- Research organization: Cloudflare.
- Report: Q3 2026 DDoS Threat Report.
- Reporting period: July–September 2026.
- Publication date: October 29, 2026.
- Network-layer DDoS attacks: 18.2 million.
- HTTP DDoS requests: 14.4 trillion.
- Quarterly increase: Approximately 38%.
- Attacks under 10 minutes: 96%.
- Attacks below 1 Gbps: 98%.
- Attacks exceeding 1 Tbps: 251, down from 805 in Q2.
- DNS amplification growth: 215%.
- Botnet variants highlighted: Dysphoria and Evooo1Bot.
- Primary source: Cloudflare’s official quarterly threat report.
Frequently Asked Questions
How many DDoS attacks did Cloudflare block in Q3 2026?
Cloudflare reported mitigating 18.2 million network-layer DDoS attacks during Q3 2026, alongside 14.4 trillion malicious HTTP requests.
How much did DDoS activity increase?
Network-layer attacks increased from 13.2 million in Q2 to 18.2 million in Q3, representing approximately 38% quarterly growth.
What percentage of attacks lasted under 10 minutes?
Cloudflare reported that 96% of network-layer DDoS attacks lasted less than 10 minutes.
Did attacks above 1 Tbps increase?
No. Cloudflare recorded 251 attacks exceeding 1 Tbps in Q3, compared with 805 in Q2.
Why are DNS amplification attacks dangerous?
They can exploit reflection-capable DNS infrastructure to send amplified traffic toward a victim, consuming network bandwidth and potentially disrupting services.
Can a small website be affected by an attack below 1 Gbps?
Yes. Impact depends on hosting capacity, network limits, application architecture, and the availability of DDoS mitigation.
Does a DDoS attack mean hackers accessed private data?
Not necessarily. DDoS attacks primarily target service availability. Data compromise requires separate evidence of unauthorized access or another security incident.
What should businesses do first to improve DDoS protection?
Review upstream protection, restrict unnecessary origin exposure, enable useful traffic monitoring, and prepare an incident-response process.
Final Takeaway
Cloudflare’s Q3 2026 DDoS report shows a significant increase in network-layer attacks, reaching 18.2 million mitigated incidents during the quarter.
Although the largest floods became less frequent, shorter and lower-bandwidth attacks remained a growing operational concern.
Businesses should prioritize continuous monitoring, automated mitigation, hardened infrastructure, and recovery procedures that can respond quickly to repeated disruptions.
Already faced a DDoS-related website outage? Our related technical guide explains Hostinger null-routing and practical recovery measures.
Read Next: Hostinger Null-Route DDoS Attack — How We Fixed Our Website Outage →
