Cloudflare Reports 18.2 Million DDoS Attacks in Q3 2026

Cloudflare’s DDoS report for Q3 2026 records a total of 18.2 million network-layer attacks and 14.4 trillion HTTP requests mitigated between July and September. Cloudflare, citing the 26th edition produced by Cloudforce One, notes an average of 8,226 network-layer attacks per hour (roughly one attack every 0.44 seconds), with mitigated traffic reaching 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer.

Short-burst floods—lasting under 10 minutes and staying below 1 Gbps—surged by 208% year on year. The report states that 96% of these floods ended in under 10 minutes and 98% stayed under 1 Gbps, still enough to overwhelm many targets. Hyper-volumetric attacks over 1 Tbps declined by about 69%, falling from 805 incidents in Q2 to 251 in Q3, following early 2026 police takedowns of four IoT botnets (Aisuru, KimWolf, JackSkid, Mossad).

Attack techniques shifted away from CLDAP reflection, which collapsed by 99.5% to 0.05% of incidents, toward DNS amplification and UDP floods. Cloudforce One reports a 215% rise in DNS amplification and a 122% rise in general UDP floods, with UDP floods comprising 31.31% of all network-layer attacks. Mirai-derived traffic remained a major factor, with August 2026 traffic peaking at 57.23 petabytes (46.5% of mitigated network bytes) and Dysphoria and Evooo1Bot noted as newer variants in circulation.

Geographically, the United States overtook China as the most-attacked country, while Canada and Israel moved up in the rankings. The report attributes much of the activity to DDoS-for-hire “booter” platforms targeting software, gambling, and IT firms, and stresses that most organisations benefit from automated, always-on mitigation rather than manual responses. Cloudflare also promotes its free DDoS Botnet Threat Feed, now with over 800 participating networks.