Cloudflare Q3 report: DDoS shifts to short sub-1-Gbps bursts as terabit floods decline

Cloudflare mitigated 18.2 million network-layer DDoS attacks in the third quarter of 2026 — roughly 8,200 every hour, or about one every half second — according to its latest quarterly threat report. The headline finding is a change in the shape of the threat rather than its volume: attacks are becoming smaller, shorter and far more numerous, while record-scale floods have become rarer.

The report, the 26th edition of the series published on the Cloudflare blog on October 29, covers July through September and was produced by Cloudforce One, Cloudflare's threat intelligence organization, drawing on traffic observed across the company's global network.

Short bursts, low bandwidth

Short, low-bandwidth attacks — those ending in under 10 minutes and never exceeding 1 Gbps — surged by 208%. Of all network-layer attacks mitigated in the quarter, 96% finished within 10 minutes and 98% stayed below 1 Gbps. That is small by modern DDoS standards but, as the report points out, still enough to overwhelm an unprotected server or website.

Cloudflare links the pattern to DDoS-for-hire "booter" services, whose activity clustered around the computer software, gambling and casino, and information technology sectors.

At the other end of the spectrum, hyper-volumetric attacks above 1 Tbps fell nearly 69% from Q2, from 805 incidents to 251. The report connects this to law-enforcement action in early 2026 that dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. New variants such as Dysphoria and Evooo1Bot have since surfaced, and Cloudflare cautions that IoT botnets remain a durable, high-volume threat. Mirai-family activity peaked in August at 57.23 PB of mitigated traffic, 46.5% of all network-layer bytes that quarter, and included one sustained attack lasting 49.7 hours.

In total, Cloudflare blocked 14.4 trillion HTTP DDoS requests during the quarter, amounting to 272.6 PB of network-layer traffic and 95.1 PB at the HTTP layer.

Attack vectors rotate

The sharpest vector change was the collapse of CLDAP reflection, down 99.5% quarter over quarter to just 0.05% of attacks. The technique, which tricks publicly reachable directory controllers on UDP port 389 into sending amplified responses to a spoofed victim address, had jumped 580% in the first half of the year before attackers abruptly abandoned it.

They pivoted to other connectionless protocols instead. DNS amplification rose 215% and now accounts for 3.43% of network-layer attacks, abusing open DNS resolvers in a similar reflection pattern. Generic UDP floods climbed from 14.06% to 31.31% of attacks, making them the dominant category of the quarter. Because UDP involves no handshake, a target must process each incoming packet even when nothing is listening, which makes it a convenient vehicle for volumetric floods.

Targets spread across sectors and countries

Media, production and publishing stayed the single most-attacked industry, but its share fell to roughly a quarter of its Q2 level as attacker attention spread more widely. The Internet sector climbed from outside the top ten to sixth place, while consumer services and adult entertainment entered the ranking at eighth and ninth.

Geographically, the United States reclaimed the top spot from China — the two have traded first and second place through 2026 — with Indonesia rising to third at 2.93% of total attacks. Canada jumped from sixteenth to sixth, which Cloudflare attributes to attacks against its retail, telecommunications, service provider and marketing sectors amid a period of trade disputes. Israel climbed seven places to tenth following sustained DDoS activity in mid-September.

Why it matters

For anyone operating web infrastructure, the report's central lesson is that DDoS defense can no longer be judged by peak capacity alone. Nearly all attacks now arrive small and end quickly, and Cloudflare notes that most are over long before a human analyst could react to an alert — making automated, always-on mitigation the baseline requirement rather than an upgrade.

The rapid vector churn matters for defense planning too: filters tuned to last quarter's threats, such as CLDAP, are already obsolete, while UDP-based floods remain the workhorse. Cloudflare says its own network of 330-plus cities and 500 Tbps of capacity absorbs this automatically, and it offers a free DDoS botnet threat feed to hosting providers and ISPs, which more than 800 networks have joined, as a route to identifying and taking down abusive infrastructure upstream.