Cloudflare Q3 DDoS Report: Giant Attacks Fall 69%

Cloudflare blocked 18.2 million network-layer distributed denial-of-service (DDoS) attacks in the third quarter of 2026, up 208% on the same quarter last year, according to its latest DDoS threat report, published on 29 October.

That works out to about 8,226 attacks an hour, or roughly one every 0.44 seconds. Cloudflare also mitigated 14.4 trillion malicious web (HTTP) requests over the quarter. On X, the company summed up the quarter as attackers shifting “to shorter, high-frequency strikes”.

A DDoS attack tries to knock a website or network offline by flooding it with junk traffic, often sent from large networks of hijacked devices known as botnets. Cloudflare says its network sits in front of more than 20% of the web, so its figures give a broad view of the trend, though they cover only traffic Cloudflare itself sees.

Fewer giant attacks

The biggest change was at the top end. Cloudflare counted 251 “hyper-volumetric” attacks, those above 1 terabit per second, in the third quarter, down from 805 in the second. The company said these attacks “plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year.”

Cloudflare named those botnets as Aisuru, KimWolf, JackSkid and Mossad. It added that “variants continue to emerge”, pointing to two new ones, Dysphoria and Evooo1Bot.

Botnets built on Mirai, malware that hijacks poorly secured routers, cameras and other connected devices, remained heavy hitters. Mirai traffic peaked in August at 57.23 petabytes, 46.5% of all network-layer attack traffic Cloudflare mitigated that month. The longest Mirai attack ran for 49.7 hours, from 19 to 21 August.

More short bursts

Most attacks were small and fast. Cloudflare says 96% ended in under 10 minutes, and 98% stayed below 1 gigabit per second. That is still, in its words, “more than enough to overwhelm a server or website” that has no protection.

The company calls these short, frequent bursts the “operational signature of DDoS-for-hire ‘booter’ services”, which rent out attack capacity cheaply. In the third quarter they mainly hit computer software companies, gambling and casino sites, and IT firms.

Attack methods also shifted. Attacks abusing CLDAP, a directory protocol that can be used to amplify traffic, collapsed by 99.5% after rising 580% in the first half of the year. DNS amplification attacks rose 215%, and general UDP floods rose 122%.

The United States was the most-attacked location, followed by China and Indonesia. Canada jumped from 16th to sixth, and Israel climbed seven places to tenth. Media, production and publishing stayed the most-attacked industry, though with about a quarter of its share in the previous quarter.

Why short attacks are the harder problem for defenders

The fall in giant attacks is welcome, and Cloudflare’s own wording links it only tentatively to the botnet takedowns. Its warning that new variants keep appearing matters just as much. Police can seize servers, as in the Virtualine bulletproof hosting seizure, but the insecure devices that botnets recruit stay online. New malware can round them up again, and researchers keep finding fresh routes, such as the Popcorn Time updater that Eye Security disabled to head off a botnet.

For most organisations, the bigger lesson is the short-burst trend. An attack that is over in a few minutes ends before a person can spot it and react. That favours automatic, always-on filtering over manual response. And because 98% of attacks stayed under 1 Gbps, small and mid-sized sites are the ones most exposed: the traffic is modest by internet standards but can still swamp a single server or a small connection.

The rise in DNS amplification is a reminder that badly configured servers on the open internet help attackers multiply their traffic. Network operators who lock down their own DNS servers reduce the pool attackers can use.

Cloudflare is also offering a free DDoS botnet threat feed that lets internet service providers identify infected devices on their own networks. It says more than 800 networks have signed up. Cleaning up infected devices at the source depends on that kind of cooperation, because a flood that is not stopped early can hit a whole country’s connection, as Kentik found when DDoS traffic hit North Korea’s internet for 32 hours.