Cloudflare reports 18.2 million network layer DDoS attacks in Q3

Cloudflare reports a continued surge in network-layer DDoS activity, with its systems autonomously mitigating 18.2 million L3 DDoS attacks and handling 14.4 trillion HTTP DDoS requests in the third quarter of 2026. The firm notes an average of about 197,400 attacks per day, equating to roughly one attack every 0.44 seconds. This follows 13.2 million L3 DDoS attacks in Q2 and 10.0 million in Q1 2026, with the rise attributed in part to DDoS-for-hire booter and stresser services.

Short-burst, low-bandwidth attacks lasting under 10 minutes and at around 1 Gbps surged by 208% in the period, according to Cloudflare’s threat intelligence team, Cloudforce One.

The firm also highlights shifting attack patterns: hyper-volumetric attacks exceeding 1 Tbps declined by 69% from Q2 to Q3 (805 attacks in Q2 to 251 in Q3), a change Cloudflare attributes to law enforcement actions against various botnets earlier in the year. While DNS amplification attacks jumped 215% to represent 3.43% of all network-layer attacks, CLDAP floods declined. Among the most targeted sectors were media, production and publishing; IT services; gambling and casinos; software; and telecommunications.

The United States, China, Indonesia, the United Kingdom and Türkiye were the top five attacked countries, with Canada and Israel entering the top 10, driven by activity against retail, telecoms and marketing sectors. The report also notes emerging variants like Dysphoria and Evooo1Bot as ongoing concerns.