- Cloudflare says it blocked 18.2 million network-layer DDoS attacks in Q3 2026, while attacks above 1 Tbps fell to 251 from 805 in Q2.
- Cloudflare's report says 98% of attacks stayed under 1 Gbps, enough to overwhelm a server or website, so defences sized only for giants may miss the common case.
- Ask vendors how fast mitigation starts without human action, and check whether your DNS resolvers or domain controllers can be used to reflect attacks.
Record-size attacks make the headlines. Cloudflare's Q3 figures suggest the more common attack is small and brief: a swarm of short floods, not one giant wave. That is the argument here. The figures are Cloudflare's. The argument built on them is WebPulse's.
What Cloudflare reported
Cloudflare's threat intelligence team, Cloudforce One, published its Q3 2026 DDoS report on October 29. A DDoS attack floods a target with traffic until it cannot serve real users. Cloudflare says it automatically blocked 18.2 million network-layer attacks and 14.4 trillion HTTP attack requests in the quarter. That averages about 8,226 network-layer attacks an hour, or one every 0.44 seconds. Cloudflare says the 18.2 million is up 208% from Q3 2025.
The mix changed. Cloudflare says short, mid-range, high-count attacks picked up speed. It calls this the signature of DDoS-for-hire "booter" services. IT firms, software companies and gambling and casino businesses took most of them, Cloudflare says.
At the other end, attacks above 1 Tbps fell to 251 from 805 in Q2. Cloudflare notes the drop coincides with law enforcement action early in 2026 that dismantled four large IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. It says the fall may reflect that action. A botnet is a network of hijacked devices that attackers rent or control.
The giants have not vanished. Cloudflare says new variants such as Dysphoria and Evooo1Bot are emerging. Mirai-classified mitigation peaked in August at 57.23 PB. The longest Mirai attack ran 49.7 hours. Cloudflare also says the largest attacks still regularly exceed 1 Tbps, at a pace of hundreds per quarter.
How the attacks work
Attackers changed their methods too. One method is reflection. The attacker sends a small request with a forged return address, the victim's. A public server answers with a much larger reply, and the victim receives it.
CLDAP attacks work this way. They abuse public domain controllers on UDP port 389. Cloudflare says CLDAP rose 580% quarter over quarter in the first half of the year. In Q3 it fell to 0.05% of attacks.
Attackers moved to similar tools. Cloudflare says DNS amplification rose 215% to 3.43% of network-layer attacks. It abuses open DNS resolvers in the same small-query, large-reply pattern. Other UDP floods rose from 14.06% to 31.31%. UDP has no handshake, so a target must check each packet for a listening application and respond. That uses up its network and computing power.
Why the swarm is the real test
A heading in Cloudflare's report says 98% of attacks stayed under 1 Gbps, which is "more than enough to overwhelm a server or website." The report does not detail the breakdown. Still, it points to a gap. It is easy to judge exposure by the largest attack in the news. The size that matters may be the one that fits your own link.
There is a human side. In Cloudflare's data, the typical attack finishes faster than a person can react to an alert. Picture an engineer paged at night. By the time they open the dashboard, the burst may be over, and the next one starting. This is why Cloudflare stresses automatic mitigation. A plan that depends on someone noticing is slower than the attack.
The targets also moved. Media, Production & Publishing is still the top industry target. Cloudflare puts its share at about a quarter of the Q2 level, as attacks spread across more sectors. The Internet category climbed into sixth place, having sat outside the top 10. Consumer Services reached #8 and Adult Entertainment #9. By location, the United States was most attacked and China was #2. Indonesia entered the top three at 2.93%. Canada jumped from #16 to #6, and Israel moved up 7 spots to #10.
What leaders should ask
Start with speed. Ask your provider whether mitigation starts without a human decision, and how long a ten-minute burst runs before it is stopped. Then ask whether your protection and contracts are sized for frequent small attacks, not only record-size ones.
Next, check whether you add to the problem. Ask your infrastructure team if any DNS resolver or domain controller faces the public internet, since reflection attacks rely on such servers. Hosting providers and networks can also use Cloudflare's free DDoS Botnet Threat Feed. Cloudflare says over 800 networks have signed up.
One caution. Cloudflare sells DDoS protection, and these figures come from its own network. They are a strong view of attack patterns, not a count of every attack. The report also counts attacks and sizes, not the harm to any organisation.
The giants make the news. The swarm is the attack most organisations are likelier to meet.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cloudflare.
