Cloudflare has mitigated a record 18.2 million network-layer (Layer 3) distributed denial-of-service (DDoS) attacks in Q3 2026, a 38% rise from the prior quarter. That’s equivalent to about 8,226 attacks per hour, or one every 0.44 seconds. Alongside that, the company handled 14.4 trillion HTTP DDoS requests during the same span.
To put that in perspective, Cloudflare recorded 13.2 million L3 network-layer DDoS attacks in Q2 and 10 million in Q1. The surge has been attributed to the growing activity of “booter” or “stresser” services that enable anyone to launch attacks cheaply and easily.
Smaller Attacks Rise, Mega-Attacks Drop
Short, low-bandwidth bursts—attacks under 10 minutes and up to 1 Gbps—skyrocketed by 208%, becoming the lion’s share of DDoS activity. By contrast, hyper-volumetric attacks over 1 terabit per second dropped precipitously, falling from 805 occurrences in Q2 to just 251 in Q3. This sharp decline is likely tied to recent law enforcement crack-downs on groups such as AISURU, KimWolf, JackSkid, and Mossad earlier in the year.
New attackwares like Dysphoria and Evooo1Bot have also emerged, complicating the landscape even as some older threats fade. Meanwhile, the methods used are shifting: CLDAP-based floods are decreasing, whereas DNS amplification attacks have exploded—rising 215% and now accounting for 3.43% of all network-layer DDoS attacks.
Who’s Getting Hit Hardest
Industries most targeted include media and publishing, IT and services, gambling and casinos, software firms, and telecommunications providers. On the national level, the U.S., China, Indonesia, the U.K., and Türkiye lead in volume of attacks. Canada and Israel have also moved into the top ten, primed by attacks aimed at telecommunications, retail, and marketing sectors.
Cloudflare’s latest figures paint a complex picture: massive numbers of smaller attacks, shrinking large-scale bursts, but also rising sophistication and shifting vectors. Even as law enforcement appears to be disrupting big actors, the threat ecosystem keeps evolving.
Why this matters, and what to watch: The explosion of short, low-bandwidth attacks suggests attackers are leaning toward scale and frequency over brute force. Organizations now need defenses focused on agility and automation to stay ahead. Legal actions seem effective against certain large botnets, but newly emergent tools like Dysphoria and DNS amplification techniques show attackers quickly adapt. Monitoring threat-share trends across industries and geographies will be critical in the next reporting cycle.
