Cloudflare Q3 2026 DDoS Report: About 8,226 Network-Layer Attacks an Hour, More Short Bursts, Fewer Above 1 Tbps

On October 29, 2026, Cloudflare published the 26th edition of its DDoS Threat Report, covering the third quarter of 2026 (July to September) and drawn from its own network. It says it autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests, about 8,226 network-layer attacks per hour. The main trend is shorter, more frequent attacks: short, low-bandwidth attacks under 10 minutes surged, while hyper-volumetric attacks above 1 Tbps fell sharply.

Start with the totals. The network-layer figure works out to about 197,400 attacks a day, or one every 0.44 seconds, and the mitigated traffic came to 272.6 PB at the network layer and 95.1 PB at the HTTP layer. The report says the 18.2 million attacks are up 208% from the same quarter of 2025, with 96% ending in under 10 minutes and 98% staying under 1 Gbps. One caution: the 208% appears twice with different subjects. The body attaches it to the total of network-layer attacks against Q3 2025, while the key-insights list attaches it to short-burst, low-bandwidth attacks and names no baseline. When you cite it, say which reading you use.

Hyper-volumetric attacks went the other way. Network-layer attacks above 1 Tbps fell from 805 in Q2 to 251 in Q3, a drop of nearly 69%. The report links this to law enforcement action in early 2026 that dismantled four of the largest IoT DDoS botnets, Aisuru, KimWolf, JackSkid and Mossad; the key insights word it as "possibly a reflection" and do not assert cause. IoT botnets still remain a durable threat, with new variants such as Dysphoria and Evooo1Bot. Mitigation classified as Mirai peaked in August at 57.23 PB, including four days, August 16, 19, 23 and 25, that each cleared three petabytes, and the longest sustained Mirai attack ran 49.7 hours from August 19 to 21. The report explicitly calls 46.5% a share of Q3 mitigated network-layer bytes, yet 57.23 PB is about 21% of its stated 272.6 PB quarterly total. The figures do not reconcile as written, and the report does not explain the difference.

The attack methods changed too. CLDAP reflection attacks had surged 580% quarter over quarter in the first half and then fell to 0.05% of attacks in Q3, which the report puts at a 99.5% drop. DNS amplification rose 215% to 3.43% of network-layer attacks, and other UDP floods climbed from 14.06% to 31.31%, an increase of about 122%. UDP is connectionless, which makes it a convenient carrier for raw volumetric traffic.

The targets spread out. Media, Production and Publishing stayed the most-attacked industry, but its share is about a quarter of its Q2 level. Internet rose from outside the top ten to sixth, and Consumer Services and Adult Entertainment reached eighth and ninth. The report says the short, mid-range, high-count pattern is the signature of for-hire "booter" services and mainly hit computer software, gambling and casinos, and information technology. By place, the United States was the most attacked, China second, and Indonesia entered the top three at 2.93%. Canada jumped from 16th to 6th, and Israel climbed seven places to 10th.

Keep in mind that this is a protection vendor's statistics from its own network, so the rankings reflect attacks on Cloudflare customers, not the whole Internet. Cloudflare adds that its protection runs in more than 330 cities on 500 Tbps of capacity, and that over 800 networks have signed up for its free botnet threat feed for service providers. For operations teams, the lesson is that most attacks end before a person could read the alert, so defense must be automatic, and that attack count matters as much as the size of any single attack.