Cloudflare reports mid-range DDoS attacks surged 208% in Q3

Cloudflare’s DDoS Threat Report for 2026 Q3, produced by Cloudforce One, shows a quarter of notable vector and target shifts. Short-burst, mid-range DDoS attacks – common with booter services – surged by 208%, while hyper-volumetric attacks above 1 Tbps fell by around 69%, a change the report attributes to law enforcement actions against four major IoT botnets earlier in the year. DNS amplification and general UDP floods rose, with DNS amplification up 215% and UDP floods up 122%.

CLDAP reflection attacks collapsed to 0.05% of all attacks in Q3, marking the most dramatic vector shift, while DNS amplification accounted for 3.43% of network-layer attacks and other UDP floods rose in share as well. Cloudflare notes that IoT botnet activity remains a persistent high-volume threat, with Mirai-class mitigations peaking in August at 57.23 PB and four days in the month clearing three petabytes of traffic.

In terms of scale and geography, Cloudflare mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026, equating to roughly 8,226 network-layer attacks per hour and 197,400 per day, with mitigated traffic totalling 272.6 PB at the network layer and 95.1 PB at the HTTP layer. The most-attacked industry remained Media, Production & Publishing, though shares shifted toward Internet, Consumer Services and Adult Entertainment sectors.

Geographically, the United States remained the most-attacked location, with China at number two and Indonesia rising to the top three at 2.93% of total attacks. Canada and Israel also climbed rankings, tied to broader geopolitical tensions and domestic events. The report emphasises continued global defence and collaboration, including Cloudflare’s free DDoS Botnet Threat Feed for Service Providers and Radar for ongoing visibility.