Cloudflare DDoS report Q3 2026: 18.2M attacks, but terabit floods fell 69%

Cloudflare's DDoS Threat Report for the third quarter of 2026 describes an attack landscape that has split in two: far more short, small attacks from rented "booter" services, and far fewer of the giant, terabit-class floods that dominated headlines last year. The company says it blocked 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests between July and September, and ties the drop in the biggest attacks to a law enforcement action against four large IoT botnets earlier in 2026.

Key points

• Cloudflare says it mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026, about 8,226 network-layer attacks per hour.
• Short-burst attacks lasting under 10 minutes and staying under 1 Gbps surged 208%; the report says 96% of network-layer attacks ended in under 10 minutes and 98% stayed under 1 Gbps.
• Hyper-volumetric attacks above 1 Tbps fell from 805 in Q2 to 251 in Q3, a drop of nearly 69%.
• CLDAP floods collapsed by 99.5% quarter over quarter, while DNS amplification rose 215% and other UDP floods climbed from 14.06% to 31.31% of network-layer attacks.
• The United States became the most-attacked location again, ahead of China and Indonesia; Canada jumped from 16th to 6th place.

What to do

The report is a threat survey, not an advisory, but it points to concrete checks for anyone who runs internet-facing services:

• Do not rely on a bandwidth threshold. With 98% of network-layer attacks staying under 1 Gbps, a link that only alarms on multi-gigabit floods will miss most of what is aimed at it. Look at packet rate and connection state, not just throughput.
• Close open DNS resolvers. The 215% rise in DNS amplification feeds on resolvers that answer queries from anyone. If you run one, restrict it to your own networks and rate-limit responses.
• Filter spoofed traffic at the edge. Reflection attacks depend on forged source addresses. Network operators can apply source address validation (BCP 38 style filtering) so their customers cannot be used as a launch point.
• Expect automatic mitigation to matter more than human response. If most attacks end in under ten minutes, an on-call engineer cannot react in time. Whatever protection you use needs to trigger without a person.
• Check your own devices. The botnets in this story are built from cameras, video recorders and routers. Change default passwords and update firmware on such devices.

What happened

Cloudforce One, Cloudflare's threat intelligence team, published the 26th edition of the company's DDoS Threat Report on 29 October 2026, returning to a quarterly schedule after a combined report for the first half of the year. The figures come from traffic on Cloudflare's own network, so they describe what Cloudflare saw and blocked, not the whole internet.

Across Q3, the company says its systems automatically mitigated 18.2 million network-layer attacks and 14.4 trillion HTTP requests that were part of DDoS attacks. That is roughly 197,400 network-layer attacks a day, or one every 0.44 seconds. The mitigated traffic totalled 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer.

The headline finding is the shape of the attacks. The report describes a surge in "short-burst, mid-range, high-count" attacks, the signature of DDoS-for-hire services, which mostly hit computer software, gambling and casino, and information technology companies. Cloudflare says these short, low-bandwidth attacks, under ten minutes and under 1 Gbps, rose 208%. In its framing, 96% of network-layer attacks ended in under ten minutes and 98% never passed 1 Gbps, which is still enough to take down an unprotected server or website.

At the other end, network-level attacks above 1 Tbps dropped to 251 in Q3 from 805 in Q2. Cloudflare links that fall to law enforcement action in early 2026 against four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid and Mossad. It cautions that the problem has not gone away: new variants named Dysphoria and Evooo1Bot are emerging, and Mirai-classified traffic peaked in August at 57.23 petabytes, which the report puts at 46.5% of all mitigated network-layer bytes in Q3. Four days in August (the 16th, 19th, 23rd and 25th) each cleared more than three petabytes, and the longest sustained Mirai attack of the quarter ran 49.7 hours, between 19 and 21 August.

Background

The four botnets Cloudflare names were the subject of a joint action by US, German and Canadian authorities in March 2026. BleepingComputer reported on 20 March that the operation disrupted command-and-control infrastructure, including domains and virtual servers, for Aisuru, KimWolf, JackSkid and Mossad, and cited the US Justice Department as saying more than three million IoT devices, such as web cameras, video recorders and Wi-Fi routers, had been infected or ensnared. According to court documents cited in that report, Aisuru was linked to more than 200,000 commands to launch attacks, JackSkid to more than 90,000, KimWolf to more than 25,000 and Mossad to more than 1,000. Those counts are allegations in court filings, not findings. BleepingComputer's report mentioned no arrests, and a disruption of control servers does not clean the infected devices themselves, which is why the ecosystem can regrow under new names.

Cloudflare's numbers describe its own network. Other vendors measure different networks, so their figures cannot simply be added together or compared.

The numbers

The clearest change is at the top end. The chart below uses the two figures Cloudflare gives for attacks above 1 Tbps.

Q2 2026805

Q3 2026251

Network-layer DDoS attacks above 1 Tbps seen by Cloudflare (attacks per quarter)

	attacks per quarter
Q2 2026	805
Q3 2026	251

Source: Cloudflare DDoS Threat Report 2026 Q3

Attack methods changed as well. CLDAP reflection, which abuses public domain controllers on UDP port 389, had grown 580% quarter over quarter in the first half of the year, then fell to 0.05% of attacks in Q3. Attackers moved to other connectionless protocols. DNS amplification rose 215% to 3.43% of network-layer attacks, and general UDP floods more than doubled in share:

Q2 202614.06%

Q3 202631.31%

Plain UDP floods as a share of network-layer DDoS attacks (%)

	%
Q2 2026	14.06%
Q3 2026	31.31%

Source: Cloudflare DDoS Threat Report 2026 Q3

On targets, Media, Production and Publishing remained the most-attacked industry, but its share is roughly a quarter of its Q2 level. The Internet industry rose from outside the top ten to sixth, and Consumer Services and Adult Entertainment reached eighth and ninth. By location, the United States took first place from China, China was second, and Indonesia rose to third with 2.93% of attacks. Canada moved from 16th to 6th, which the report links to attacks on retail, telecommunications, service providers and advertising companies, and Israel moved up seven places to 10th after sustained activity in mid-September.

A note on reading the percentages: the report attaches the 208% figure both to short-burst attacks and, in the same section, to the 18.2 million total as a year-on-year increase. We read the two as describing the same shift, but the wording is not perfectly clear, so treat the 208% as Cloudflare's own comparison against Q3 2025, not as an independent measurement.

How the attacks work

Two of the techniques in the report are worth understanding.

Reflection and amplification. The attacker sends a small request to a public server, such as a DNS resolver or a CLDAP domain controller, with the victim's address forged as the sender. The server sends a much larger reply to the victim. The attacker spends little bandwidth, and the victim receives traffic from many legitimate servers, which makes blocking by source address hard. DNS amplification works the same way as CLDAP; the report does not say why attackers switched.

UDP floods. UDP has no handshake, so an attacker can send huge numbers of packets to random or chosen ports and force the target to spend resources checking for a listening application and replying. Because they need no reflector, they are cheap to launch from infected devices.

What it means

For site operators, the practical lesson is that the common DDoS is small and quick. DDoS-for-hire services can knock an unprotected server offline for minutes at a time, which is long enough to cause lost sales or failed logins. Protection that depends on a human noticing and calling a provider is too slow when the typical attack is over in ten minutes. Cloudflare, naturally, argues for automatic mitigation, and it says its own systems detect and block attacks without human intervention; that is a vendor's view, but the duration data supports the general point.

For network operators and device makers, the takedown shows both the value and the limits of disruption. Cloudflare links a drop of nearly 69% in terabit-scale attacks to the takedown (the report suggests the link with 'possibly'), yet Mirai-family traffic still made up close to half of mitigated network-layer bytes. As long as cheap cameras and routers ship with default passwords and no update path, new botnets will replace old ones.

For readers following our coverage of internet reliability, this report is a companion to Cloudflare Radar's Q3 2026 disruption review, which counted outages caused by shutdowns and power failures rather than attacks.

What we don't know yet

• Whether the drop in giant attacks lasts. One quarter of data cannot show whether the fall from 805 to 251 is a lasting effect of the takedown or a pause while new variants grow.
• Causes of the vector shifts. Cloudflare reports that CLDAP collapsed and DNS amplification rose, but does not explain why attackers switched.
• How other networks fared. The data is Cloudflare's alone. We found no other vendor's Q3 2026 DDoS report when we wrote this, so we cannot say whether others saw the same pattern.
• The geopolitical links. The report ties Canada's and Israel's jumps to trade disputes and regional tensions, but a rise in attacks against a country's networks is not proof of a political motive.

What to watch next

Watch for Cloudflare's Q4 report, which will show whether terabit-scale attacks return as botnets such as Dysphoria and Evooo1Bot grow, and for DDoS reports from other providers covering the same quarter. Any further law enforcement action against botnet operators, and any regulation of default credentials on consumer devices, would also affect the numbers.

Sources

• Cloudflare: DDoS Threat Report 2026 Q3, "More swarms, fewer giants" (primary source)
• BleepingComputer: Aisuru, KimWolf, JackSkid and Mossad botnets disrupted in joint action
• US Justice Department press release on the botnet disruption, as linked by BleepingComputer (we could not open this page ourselves)