For most of the past two years, DDoS headlines were about records: the biggest flood, the most packets per second, the highest terabit count. Cloudflare's latest quarterly report tells a different story. In the third quarter of 2026 the company saw more attacks than ever, and far fewer of the giant ones. Cloudflare's title for the report sums it up: "More swarms, fewer giants."
The 26th edition of Cloudflare's DDoS Threat Report says the company mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests during the quarter. That works out to about 8,226 attacks an hour, 197,400 a day, or one every 0.44 seconds. In volume terms, Cloudflare absorbed 272.6 petabytes of network-layer attack traffic and 95.1 petabytes at the HTTP layer.
The volume keeps climbing
A quick definition first. A network-layer attack floods a target's connection with raw packets (UDP, DNS, TCP and so on) to fill its bandwidth or exhaust its network equipment. An HTTP, or application-layer, attack sends web requests that look legitimate, aiming to overwhelm the servers and applications behind a site.
The network-layer count keeps rising quarter after quarter. The Hacker News notes that Cloudflare recorded 10.0 million such attacks in Q1 2026 and 13.2 million in Q2, so Q3's 18.2 million is a 38% jump over the previous quarter. Measured year over year against Q3 2025, the figure in SiliconANGLE's headline, network-layer attacks rose 208%.
Small, short attacks made up most of that growth. According to Cloudflare, 96% of network-layer attacks ended within 10 minutes and 98% stayed under 1 Gbps. Attacks that were both under 10 minutes and under 1 Gbps surged by 208%. Cloudflare reads this profile as the signature of DDoS-for-hire "booter" services, which rent out attack capacity for a fee, and The Hacker News reports that the increase has been linked to such services, which are responsible for hundreds of thousands of attacks.
Where the giants went
The largest attacks moved the other way. Cloudflare counted 251 attacks above 1 Tbps in Q3, down from 805 in Q2, a drop of about 69%.
Cloudflare tentatively links the decline to law-enforcement action earlier in the year. As SiliconANGLE notes, the U.S. Department of Justice announced in March that it had disrupted four IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. Botnets built from hijacked routers, cameras and other internet-connected devices have been behind many of the record-breaking floods, so taking out four of them plausibly removed a lot of terabit-scale capacity.
The ecosystem has not gone quiet, though. Cloudflare reports new botnet variants it calls Dysphoria and Evooo1Bot. Traffic it classified as Mirai, the IoT malware family whose leaked source code still underpins many botnets, peaked at 57.23 PB in August. The longest Mirai attack it recorded lasted 49.7 hours. Fewer giant attacks doesn't mean no one is building the next big botnet.
Attack methods: CLDAP collapses, DNS amplification rises
The mix of attack techniques changed sharply. Floods using CLDAP, a connectionless form of the directory protocol LDAP that attackers abuse to reflect and amplify traffic, fell 99.5% and now account for just 0.05% of attacks. DNS amplification rose 215% to 3.43% of attacks. In an amplification attack, the attacker sends small queries to third-party servers with the victim's address forged as the source, and the servers send much larger replies to the victim.
Plain DNS floods stayed the most common method at 39.3% of network-layer attacks, SiliconANGLE reports. The "other UDP floods" category more than doubled its share, from 14.06% to 31.31%.
Who got hit
The United States was the most-attacked country, followed by China and then Indonesia at 2.93%. Canada climbed from 16th to 6th place, and Israel rose to 10th.
By industry, The Hacker News lists the most targeted sectors as media, production and publishing; IT services; gambling and casinos; software; and telecoms. Media, production and publishing held the top spot again, though with only about a quarter of its Q2 share. SiliconANGLE adds that the internet sector rose from 12th to 6th, and adult entertainment entered the top 10 at 9th, up from 21st.
What It Means for Defenders
The report's main lesson for most organizations comes from the duration figures. With 96% of network-layer attacks over within 10 minutes, an attack is usually finished before anyone can read the alert, open a ticket and call a provider. Defenses that need a person to switch them on will mostly be too late.
- Use always-on mitigation. If your internet-facing services rely on on-demand DDoS protection that someone has to activate, ask your provider or ISP how long activation takes. Against attacks that last minutes, detection and filtering need to be automatic.
- Don't dismiss small attacks. 98% of attacks stayed under 1 Gbps, but Cloudflare notes that is still more than enough to overwhelm a server or website. Your exposure depends on your own link capacity, not on record-setting numbers.
- Watch your UDP exposure, DNS above all. DNS floods were the most common method and DNS amplification rose 215%. Confirm that any DNS servers you run answer only the clients they are meant to serve, so they can't be used as reflectors against others, and check that your upstream protection covers DNS and other UDP floods as well as web traffic.
- Keep your IoT devices out of botnets. The botnets named in the report are built from compromised internet-connected devices. Inventory routers, cameras and similar gear, apply firmware updates, change default credentials, and keep management interfaces off the public internet.
- Know your sector's risk. Media and publishing, IT services, gambling, software and telecoms took the most attacks. Organizations in those sectors, and the managed service providers that support them, should treat DDoS resilience as a standing requirement rather than an occasional project.
- Don't assume the takedowns will last. The drop in terabit-scale attacks followed specific botnet disruptions, and Cloudflare is already tracking new variants. Plan capacity and provider contracts on the assumption that large floods will come back.
For federal contractors working through CMMC, the report doesn't change any requirements. It is still useful supporting evidence for availability planning and incident-response tabletop exercises, since it shows the short, frequent attacks a plan needs to handle without manual steps.
