Overview
Cloudflare's Q3 2026 DDoS Threat Report, published October 29, 2026, shows attack volume still climbing while the character of attacks changes: more swarms, fewer giants.
Headline Numbers
| Metric | Q3 2026 |
|---|---|
| Network-layer (L3/L4) DDoS attacks mitigated | 18.2 million |
| HTTP DDoS requests mitigated | 14.4 trillion |
| Average network-layer attacks per hour | ~8,226 (about one every 0.44 seconds) |
| Network-layer traffic mitigated | 272.6 PB |
| HTTP-layer traffic mitigated | 95.1 PB |
The network-layer total is up about 38% from Q2 (13.2 million) and roughly 3x year over year.
Smaller, Shorter, More Frequent
- 96% of network-layer attacks ended within ten minutes
- 98% stayed below 1 Gbps
- Attacks above 1 Tbps fell from 805 in Q2 to 251 in Q3, a drop of nearly 69%
- Cloudflare observed no record-breaking attacks this quarter
Cloudflare ties the pattern to DDoS-for-hire "booter" services, which favor high volumes of short, cheap attacks over a few huge ones. Short bursts are harder to catch with manual or on-demand mitigation because they end before an analyst can respond.
Vector Shifts
- CLDAP attacks collapsed by about 99.5% quarter over quarter, to 0.05% of network-layer attacks
- DNS amplification rose 215% to 3.43% of attacks
- Other UDP floods grew from 14.06% to 31.31% of attacks
- Mirai-classified traffic peaked in August at 57.23 PB, around 46.5% of all network-layer bytes mitigated in Q3, with new variants such as Dysphoria and Evooo1Bot flagged
What Defenders Should Do
- Use always-on, automated mitigation. With most attacks ending in minutes, on-demand scrubbing and human-in-the-loop response are too slow.
- Rate-limit and filter UDP at the edge, and close or restrict unneeded UDP services.
- Lock down open resolvers and other amplification-capable services you operate.
- Harden IoT and edge devices. Mirai-family botnets still supply much of the attack capacity, so change default credentials and patch exposed devices.
- Alert on short bursts, not only sustained saturation, so repeated small attacks are visible in monitoring.
Key Takeaways
- Attack count is rising sharply even as the largest attacks decline
- Booter-style swarms favor automation on both the attacker and defender side
- Mirai variants remain a major source of attack traffic