Cloudflare logs 18.2 million DDoS attacks in Q3 2026 as short bursts dominate

Cloudflare published the 26th edition of its DDoS Threat Report on 29 October 2026, covering July through September, and the headline figure is 18.2 million network-layer attacks plus 14.4 trillion HTTP DDoS requests mitigated across its network. A write-up of the report on dev.to draws out the quarter's defining pattern: attacks are becoming shorter and more numerous while the very largest ones are becoming rarer.

An attack every 0.44 seconds

According to the report, the quarter's volume works out to 8,226 network-layer attacks per hour, roughly 197,400 per day — one every 0.44 seconds. Cloudflare says it absorbed 272.6 PB of traffic at the network layer and 95.1 PB at the HTTP layer. The company attributes this to automated detection and mitigation running across more than 330 cities and 500 Tbps of capacity. As the dev.to summary notes, at this cadence a human in the loop adds nothing: automated defense is the only kind that responds fast enough.

Short bursts grew while terabit attacks fell

The shape of the attacks is the quarter's real signal. Cloudflare found that 96% of network-layer attacks ended within ten minutes and 98% stayed below 1 Gbps, with this class of short, low-rate, high-count event up 208% year over year. The profile matches cheap DDoS-for-hire booter services rather than bespoke operations. Software companies absorbed 21.1% of these attacks, followed by gambling and casinos at 14.4%, IT and services at 14%, and telecommunications at 12.4%.

At the opposite end, attacks exceeding 1 Tbps dropped from 805 in Q2 to 251, a fall of nearly 69%. Cloudflare links the decline to law enforcement action early in 2026 against four of the largest IoT botnets — Aisuru, KimWolf, JackSkid and Mossad — while noting that successor variants named Dysphoria and Evooo1Bot have already surfaced. Fewer giant attacks but more total ones means the defensive problem is broadening rather than shrinking.

Amplification vectors rotated toward UDP

The attack-vector mix shifted hard. CLDAP floods, which had surged through the first half of 2026, collapsed to 0.05% of attacks — a 99.5% decline. Attackers rotated to other connectionless protocols instead: DNS amplification rose 215% to 3.43% of network-layer attacks, and other UDP floods climbed from 14.06% to 31.31%. The underlying technique is unchanged — a small query with a forged source address sent to an open resolver, producing a much larger reply aimed at the victim. The report's implied fix is structural: any resolver or domain controller answering recursion from the open internet is a candidate reflector and should be checked.

Mirai traffic peaked in August

Mirai-classified mitigation peaked at 57.23 PB in August and made up 46.5% of all mitigated network-layer bytes for the quarter. Four separate days — 16, 19, 23 and 25 August — each exceeded three petabytes, and the longest sustained Mirai attack ran 49.7 hours from 19 to 21 August. That duration matters operationally: a two-day sustained attack stresses staffing and escalation planning in ways a ten-minute burst never touches.

Target rankings moved

The United States returned to first place among attacked countries, ahead of China, with Indonesia third at 2.93% of attacks. Canada jumped from 16th to 6th after activity against its retail, telecom, service-provider and marketing sectors, and Israel climbed seven places to 10th following sustained mid-September attacks. By industry, media, production and publishing stayed first, though at roughly a quarter of its Q2 share, while Internet firms, consumer services and adult entertainment all entered the top ten.

Why it matters

For anyone running internet-facing services, the report reframes what a typical DDoS attack looks like: small, brief, and frequent rather than massive and sustained. That makes detection speed and automated mitigation the binding constraint, not raw scrubbing capacity. The data also carries two planning lessons. First, law enforcement takedowns depress the numbers for a quarter, but replacement botnets arrive quickly, so relief is temporary. Second, operators should plan for both ends of the duration spectrum — the ten-minute swarm that only automation catches, and the 49-hour campaign that exhausts an on-call rotation — while auditing their own exposure as an amplification reflector before someone else does.