Cloudflare’s Q3 2026 DDoS Report Finds More Short Attacks, Fewer Hyper-Volumetric Ones
Summary
Cloudflare’s Q3 2026 report records 18.2 million mitigated network-layer DDoS attacks. Short attacks surged, attacks over 1 Tbps fell, and attackers shifted from CLDAP toward DNS amplification and other UDP floods.
Key points
- Cloudflare reported mitigating 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests during Q3 2026.
- Short-burst attacks increased 208% year over year; 96% lasted under 10 minutes and 98% stayed below 1 Gbps.
- Attacks exceeding 1 Tbps fell to 251 in Q3 from 805 in Q2; the report says this coincided with early-2026 law enforcement actions against four major IoT botnets.
- CLDAP attacks fell 99.5% quarter over quarter, while DNS amplification increased 215% and other UDP floods rose to 31.31% of network-layer attacks.
- The United States was the most-attacked location, with Canada rising from #16 to #6 and Israel moving up seven places to #10.
- Cloudflare says more than 800 networks have signed up for its free DDoS Botnet Threat Feed for service providers.
Article Details
- Publisher
- Cloudflare; produced by Cloudforce One
- Report Period
- 2026-07 to 2026-09
- Scope
- Q3 2026 DDoS trends based on data from the Cloudflare network
- Key Statistics
- Cloudflare mitigated 18.2 million network-layer DDoS attacks in Q3 2026, a 208% increase from Q3 2025.
- Cloudflare mitigated 14.4 trillion HTTP DDoS requests in Q3 2026.
- Network-layer attacks exceeding 1 Tbps fell to 251 in Q3 2026 from 805 in Q2 2026.
- 96% of network-layer DDoS attacks ended in under 10 minutes; 98% stayed under 1 Gbps.
- DNS amplification attacks increased 215% quarter over quarter, reaching 3.43% of network-layer attacks.
- Recommendations
- Hosting providers, cloud computing platforms, and Internet service providers can use Cloudflare's free DDoS Botnet Threat Feed to identify and take down abusive IP addresses and accounts.
Malware
Aisuruwith law enforcement action in early 2026 that dismantled four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad.Dysphoriabotnets remain a durable high-volume threat as the ecosystem churns through new variants such as Dysphoria and Evooo1Bot. Mirai-classified mitigation peaked in August at 57.23 PB, representing 46.5% of allEvooo1Botremain a durable high-volume threat as the ecosystem churns through new variants such as Dysphoria and Evooo1Bot. Mirai-classified mitigation peaked in August at 57.23 PB, representing 46.5% of all mitigatedJackskidenforcement action in early 2026 that dismantled four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad.Kimwolfwith law enforcement action in early 2026 that dismantled four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad.Miraidurable high-volume threat as the ecosystem churns through new variants such as Dysphoria and Evooo1Bot. Mirai-classified mitigation peaked in August at 57.23 PB, representing 46.5% of all mitigated network-layerMossadaction in early 2026 that dismantled four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad.
Vendors
Products
Cloudflare Radartake down botnet nodes. For a continuously-updated view of attack trends across the Internet, visit Cloudflare Radar.DDoS Botnet Threat Feed for Service Providerswe leverage Cloudflare's unique vantage point on DDoS attacks to provide a free DDoS Botnet Threat Feed for Service Providers.
Countries
Canadaboth industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively — whileChinaacross both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively —IndonesiaThe United States was the most-attacked location in Q3 2026, while China was number #2 and Indonesia rose into the top three at 2.93% of total attacks. The U.S.-China pairing at the top is consistent with the first halfIsraeland geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively — while jugglingUnited StatesAttack targets broadened significantly across both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks —
Industries
Adult Entertainmenta wider array of industry targets, including consumer services, Internet infrastructure, and adult entertainment.Computer softwareof DDoS-for-hire "booter" services — accelerated this quarter. These attacks primarily targeted computer software, gambling and casinos, and information technology industries. Cloudflare autonomously mitigated 18.2Consumer Servicesfocus shifted away from media organizations toward a wider array of industry targets, including consumer services, Internet infrastructure, and adult entertainment.Gambling and casinos"booter" services — accelerated this quarter. These attacks primarily targeted computer software, gambling and casinos, and information technology industries. Cloudflare autonomously mitigated 18.2 millionInformation Technologythis quarter. These attacks primarily targeted computer software, gambling and casinos, and information technology industries. Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks in Q3 2026,Internetplummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoTMedia, Production, and PublishingWhile Media, Production & Publishing remained the most-attacked industry in Q3 2026, its overall share is roughly a quarter of its Q2 level, and the focus has moved across a wider set of industries. Internet rose fromRetailturbulent period of bilateral trade disputes, Canada jumped from #16 to #6, driven by attacks against its Retail, Telecommunications, Service providers & carriers, and Marketing & advertising industries.Service providers & carriersCanada jumped from #16 to #6, driven by attacks against its Retail, Telecommunications, Service providers & carriers, and Marketing & advertising industries.Telecommunicationsof bilateral trade disputes, Canada jumped from #16 to #6, driven by attacks against its Retail, Telecommunications, Service providers & carriers, and Marketing & advertising industries.