New findings from Q3 2026 reveal that cloud protection company Cloudflare blocked over 8,200 network-layer DDoS attacks every single hour. The report — covering July through September — shows attackers are favoring quick, frequent bursts over rare, massive assaults to disrupt online services.
Key DDoS Trends From Q3
Cloudflare’s threat intelligence team stopped 18.2 million network-layer attacks and mitigated 14.4 trillion malicious HTTP requests during the quarter. While “one terabit-plus” floods still happened, their frequency dropped sharply — from 805 incidents in Q2 to just 251 in Q3. Nearly all attacks proved short: about 96% ended within ten minutes, and roughly 98% stayed under one gigabit per second in traffic volume.
Fast-paced, low-volume attacks continue to have real impact. Even traffic under a gigabit per second can cripple poorly protected servers or surprise defenders who don’t have automated mitigation systems.
Shifts in Attack Methods, Targets, and Geography
Some attack types almost vanished: CLDAP reflection attacks dropped by 99.5% and made up a near-negligible share of incidents. On the other hand, DNS amplification attacks more than tripled their share over last year, and are now about 3.43% of network-layer DDoS occurrences. UDP floods became far more common too, rising from around 14% to over 31%.
The United States emerged as the most-targeted country, with Indonesia and Canada also climbing high on the hit-list. Industries under frequent attack include media, publishing, production, consumer services, and adult entertainment.
Efforts to dismantle botnets like Aisuru, KimWolf, JackSkid, and Mossad, which had infected over 3 million devices globally, appear to have reduced some large-scale threats. Mirai-related attacks remain serious though — one sustained attack lasted nearly 50 hours in late August, underlining the destructive potential of networked malware.
To counter this evolving threat, Cloudflare emphasizes the importance of automated detection and mitigation. Its networks span over 330 cities with a combined capacity of 500 Tbps, and a free botnet threat feed (joined by 800+ networks) aids service providers in rooting out abusive IPs and limiting botnet growth.
Why this matters: DDoS attacks are moving toward rapid, lower-level traffic bursts that fly under traditional defenses built for absorbing big floods. Businesses that rely on manual or slow-responding mitigation are increasingly vulnerable. As attack patterns change, protection tools and organizational playbooks need to keep pace — especially automation, threat feed integration, and cross-operator cooperation.
