Cloudflare mitigated 18.2 million network-layer distributed denial-of-service attacks during the third quarter of 2026, an average of about 8,226 attacks an hour, according to the company’s quarterly DDoS threat report. The company also reported blocking 14.4 trillion HTTP DDoS requests between July and September, equivalent to roughly 197,400 network-layer attacks a day, or one every 0.44 seconds. [1]
The volume represents a 208% increase from the same quarter a year earlier. Cloudflare said the growth was driven primarily by smaller, shorter attacks: 96% lasted less than 10 minutes and 98% remained below 1 Gbps. The company characterized the pattern as consistent with DDoS-for-hire, or “booter,” services, which can generate large numbers of relatively low-bandwidth attacks capable of overwhelming individual servers and websites. [1]
At the same time, the number of hyper-volumetric attacks above 1 Tbps fell nearly 69% from the second quarter, dropping from 805 to 251. Cloudflare linked the decline to early-2026 law-enforcement action against four major IoT botnets—Aisuru, KimWolf, JackSkid and Mossad—but warned that the ecosystem remains active. Mirai-classified activity accounted for 46.5% of mitigated network-layer bytes during the quarter, and the longest sustained Mirai attack lasted 49.7 hours. [1]
Attackers also changed their preferred amplification methods. CLDAP floods collapsed 99.5% quarter over quarter and represented just 0.05% of network-layer attacks, while DNS amplification increased 215% to 3.43% of attacks. Other UDP floods rose from 14.06% to 31.31%. Those techniques exploit connectionless protocols and, in reflection attacks, can use exposed services to send amplified traffic toward a victim without directly revealing the attacker’s infrastructure.
The targeting picture broadened beyond the media sector. Internet services rose into sixth place among targeted industries, while consumer services and adult entertainment entered the top 10. The United States was the most-attacked location, followed by China and Indonesia; Canada rose from 16th to sixth, and Israel moved up seven positions to 10th. Cloudflare said the geographic shifts coincided with trade disputes, geopolitical tensions and contentious domestic events. [1]
The report does not identify a CVE, a software vulnerability or a specific threat actor behind the activity; these are volumetric attacks rather than a single exploit campaign. Network operators should therefore prioritize upstream filtering and scrubbing capacity, anti-spoofing controls, rate limiting and rapid coordination with hosting and transit providers. Cloudflare said its free unmetered DDoS protection operates across more than 330 cities, while its DDoS Botnet Threat Feed is available to service providers seeking to identify abusive infrastructure. [1]
