Cloudflare DDoS report: Q3 2026 short-burst attacks up 208% as Tbps floods fall 69%

What Cloudflare reported

Cloudflare published the DDoS Threat Report for 2026 Q3 on 29 October 2026. It is the 26th edition, produced by Cloudforce One, the company's threat intelligence team, from data on its own network. The report covers July, August and September and returns to a quarterly schedule after a combined first-half edition.

Cloudflare says it mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in the quarter, about 8,226 network-layer attacks an hour or one every 0.44 seconds. Mitigated traffic totalled 272.6 PB at the network layer and 95.1 PB at the HTTP layer.

More swarms, fewer giants

The headline trend is a shift toward many small, short attacks. Cloudflare says short-burst, low-bandwidth attacks surged 208%, which it compares with the same quarter of 2025, and calls them the operational signature of DDoS-for-hire booter services. Of the network-layer attacks, 96% ended in under 10 minutes and 98% stayed under 1 Gbps, which the company notes is still enough to take down a server or website.

At the other end, attacks above 1 Tbps fell to 251 from 805 in Q2. Cloudflare links the drop to law enforcement action in early 2026 against four large IoT botnets, Aisuru, KimWolf, JackSkid and Mossad. It warns that new variants such as Dysphoria and Evooo1Bot keep appearing. Mirai-classified traffic peaked in August at 57.23 PB, 46.5% of mitigated network-layer bytes, and the longest Mirai attack lasted 49.7 hours.

Vectors and targets

CLDAP reflection attacks, which had surged in the first half, collapsed by 99.5% quarter over quarter to 0.05% of attacks. DNS amplification grew 215% to 3.43% of network-layer attacks, and other UDP floods rose from 14.06% to 31.31%. Media, Production and Publishing stayed the most-attacked industry, at about a quarter of its Q2 share, while Internet, Consumer Services and Adult Entertainment entered the top 10.

The United States overtook China as the most-attacked location, with Indonesia third at 2.93%. Canada jumped from 16th to 6th and Israel climbed seven places to 10th after sustained activity in mid-September.

Why it matters and what to watch

Most of these attacks end before a human analyst could react, which is why Cloudflare stresses that its detection and mitigation run without human intervention across 330+ cities and 500 Tbps of capacity. For defenders, the lesson is that small, short floods now matter more than record-breaking ones. Botnet takedowns cut the biggest attacks, but the report shows rental services filling the gap. It does not say whether attackers used AI tools. Earlier coverage of attacker use of AI is in Google's AI threat tracker report; more is in Cybersecurity. The Q4 report would show whether the botnet variants rebuild Tbps-scale capacity.

Questions people ask

How many DDoS attacks did Cloudflare block in Q3 2026?

Cloudflare says it mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests between July and September 2026, about 8,226 network-layer attacks an hour.

Why did the largest DDoS attacks drop?

Attacks above 1 Tbps fell from 805 in Q2 to 251 in Q3. Cloudflare connects this with law enforcement action in early 2026 against the Aisuru, KimWolf, JackSkid and Mossad IoT botnets, while warning that new variants keep emerging.

Which country was attacked most?

The United States, followed by China and Indonesia, according to the report. Canada rose from 16th to 6th place.

Sources

1. Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants (Cloudflare, 29 Oct 2026)
2. Cloudflare Radar (Cloudflare, 29 Oct 2026)