Hexa Tiger 
Scale My Publication 
SEO for Public Figures 
Cloudflare mitigated 18.2 million network-layer DDoS attacks in the third quarter of 2026, as short, lower-bandwidth assaults surged while attacks above 1 Tbps fell. The Cloudflare DDoS Threat report describes a threat mix dominated by many brief attacks rather than the larger events that had spiked in the prior quarter.
Cloudflare said attacks under 10 minutes and 1 Gbps increased by 208%. The report said 96% of network-layer attacks ended in under 10 minutes and 98% stayed below 1 Gbps. Such attacks can still overwhelm a server or website, according to the company.
Cloudflare DDoS Threat Shifts Toward Shorter Attacks
The Cloudflare DDoS Threat report counted 251 network-layer attacks above 1 Tbps in Q3, down from 805 in Q2. Cloudflare said that decline coincided with law enforcement action earlier in 2026 that dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. It also reported newer variants, including Dysphoria and Evooo1Bot, as evidence that IoT botnets remain a persistent high-volume threat.
Across its network, Cloudflare autonomously mitigated 14.4 trillion HTTP DDoS requests during the quarter. The mitigated traffic totaled 272.6 PB at the network layer and 95.1 PB at the HTTP layer. Cloudflare calculated that its network handled approximately 8,226 network-layer attacks per hour, or about 197,400 per day.
The Cloudflare DDoS Threat report also detailed a sharp change in attack methods. CLDAP attacks fell to 0.05% of attacks in Q3 after a 580% quarter-over-quarter surge in the first half of the year. DNS amplification rose 215% to 3.43% of network-layer attacks, while other UDP floods grew from 14.06% to 31.31%.
Targets Spread Across Industries and Locations
Media, Production & Publishing remained the most-attacked industry, but its share was roughly a quarter of its Q2 level, Cloudflare said. Internet rose from outside the top 10 to sixth place, while Consumer Services and Adult Entertainment reached eighth and ninth.
The United States reclaimed the top position among attacked locations from China. Indonesia entered the top three at 2.93% of total attacks. Canada rose from 16th to sixth, with attacks directed at its retail, telecommunications, service provider and carrier, and marketing and advertising industries. Israel moved up seven places to 10th after sustained activity in mid-September.
Cloudflare attributed the figures to analysis by Cloudforce One, its threat intelligence organization, using data from the company’s network. Readers following related Cloudflare developments can see its reporting on AI agent decisions and origin range requests. The broader domain industry also features in coverage of .ai domain revenue.
Cloudflare said its network provides free, unmetered DDoS protection across more than 330 cities and has 500 Tbps of capacity. It also offers hosting providers, cloud platforms and internet service providers a free DDoS Botnet Threat Feed. More than 800 networks worldwide have signed up, according to the company.
The company said its systems detect and mitigate attacks without human intervention. It pointed readers to Cloudflare Radar for continuously updated attack trends and said the feed is intended to help service providers identify abusive IP addresses and accounts.
Cloudflare’s report presents the quarter’s immediate operational challenge as frequent brief attacks alongside continued large events and changing methods. The company said the newly observed botnet variants and the growth in DNS amplification and UDP floods remain part of that threat picture.
