Key facts
- CLDAP reflection attacks collapsed by 99.5% in Q3 2026, falling to 0.05% of total attacks, as attackers pivoted to DNS amplification (up 215%) and UDP floods (up 122%).
- DNS amplification attacks accounted for 3.43% of network-layer attacks in Q3 2026, while UDP floods rose to 31.31%, driven by attackers exploiting open DNS resolvers and connectionless UDP protocols.
- Mirai-class botnet activity peaked in August 2026, generating 57.23 PB of mitigated traffic (46.5% of Q3 network-layer bytes), including four days exceeding 3 PB each and a 49.7-hour sustained attack.
- Cloudflare’s autonomous systems mitigated attacks without human intervention, as most attacks (96% lasting under 10 minutes) conclude before analysts can respond.
Between July 1 and Sept. 30, 2026, Cloudflare turned back 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests, according to its Q3 2026 DDoS Threat Report. The Q3 report is the 26th edition of the series, returning to a quarterly cadence after a combined H1 2026 volume report. Cloudforce One produced the report using telemetry from Cloudflare’s global network, which protects more than 20% of the web. The analysis covers evolving attack tactics observed across the company’s infrastructure.
That volume averages 8,226 network-layer attacks per hour, or one every 0.44 seconds, and roughly 197,400 per day. The 14.4 trillion HTTP DDoS requests targeted application-layer resources, distinct from the network-layer attacks that dominate the headline figures. The report highlights a shift in attack frequency and volume, with shorter, high-frequency strikes replacing large-scale volumetric attacks. Cloudflare’s autonomous systems mitigated attacks without human intervention because most strikes conclude before analysts can respond.
The network handles this volume globally, with attacks occurring at a rate of one every 0.44 seconds.
Network-layer attacks rose 208% in Q3 2026 from Q3 2025 levels. Most were short, with 96% ending in under 10 minutes and 98% remaining below 1 Gbps. The shift to short-duration attacks forces defenders to rely on automated, real-time mitigation. Cloudflare attributes the pattern to shorter, high-frequency strikes replacing large-scale volumetric attacks.
Booter services for hire drove the 208% surge in short-burst attacks, mainly hitting computer software, gambling and casino operations, and information technology firms. These services let customers launch low-bandwidth, high-frequency strikes against unprotected servers. DDoS-for-hire booter services enable low-cost, high-frequency attacks targeting unprotected servers, according to Cloudflare’s reporting. The operational signature aligns with booter service tactics, overwhelming servers that lack protection.
Attacks over 1 Tbps fell 69% in Q3 2026, dropping from 805 in Q2 to 251. Cloudflare says the decline coincided with law enforcement takedowns of four major IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. The decline suggests law enforcement actions disrupted major botnet infrastructure, though new variants like Dysphoria and Evooo1Bot persist.
On March 19, 2026, the U.S. Justice Department announced a coordinated operation that dismantled four major IoT botnets. The botnets infected more than 3 million devices across the world, including routers, cameras and DVRs. Law enforcement disrupted large-scale attack infrastructure, but the takedowns did not eliminate the IoT botnet threat entirely.
Mirai-class activity reached its peak in August 2026, with 57.23 PB of mitigated traffic representing 46.5% of network-layer bytes for the quarter. The quarter saw four days above 3 PB each and a sustained attack of 49.7 hours from Aug. 19–21, 2026. Mirai-related activity remained significant even as larger attacks declined. New Mirai-class variants, including Dysphoria and Evooo1Bot, emerged after the takedowns and sustained high-volume attacks despite law enforcement progress.
Cloudflare says CLDAP reflection attacks fell 99.5% in Q3 2026, dropping to 0.05% of all attacks. CLDAP reflection attacks jumped 580% in Q1 2026 before collapsing, after attackers exploited open directory services on UDP port 389 to amplify responses. Attackers pivoted to DNS amplification and UDP floods as alternative reflection and amplification vectors.
DNS amplification attacks increased 215% and made up 3.43% of network-layer attacks during Q3 2026. DNS amplification uses open resolvers to convert small spoofed queries into larger responses aimed at targets. Attackers use this reflection technique to amplify traffic volume, similar to CLDAP but leveraging DNS infrastructure. The surge highlights DNS amplification’s growing adoption as a primary attack vector.
UDP floods climbed 122% to reach 31.31% of network-layer attacks. These floods use connectionless protocols to deliver large volumes of packets to random or specific ports, consuming target resources without a handshake. UDP’s lack of connection requirements makes it ideal for volumetric attacks.
Cloudflare says the United States regained the top spot as the most-attacked country in Q3 2026, taking it back from China. Geopolitical tensions and trade disputes correlate with increased DDoS activity in affected regions. Domestic events likely drove the spikes in Canada and Israel.
Canada moved from 16th to sixth as attacks targeted retail, telecommunications, service providers and marketing and advertising amid trade disputes. Israel rose seven places to 10th as mid-September attacks tied to parliamentary elections and Rosh Hashanah hit the country. Broader cyber warfare activity also targeted Israel. These placement changes reflect regional event-driven targeting.
Media, production and publishing stayed the most-attacked industry in Q3 2026, although its share fell to a quarter of second-quarter levels. Internet moved to sixth place, consumer services to eighth and adult entertainment to ninth. Attackers broadened their targets beyond media, focusing on consumer-facing and infrastructure sectors. The industry shift shows a wider range of sectors now facing short-burst attention.
During Q3 2026, Cloudflare’s global network mitigated 272.6 PB of network-layer traffic and 95.1 PB of HTTP-layer traffic. The network spans 330+ cities with 500 Tbps of capacity and provides free, unmetered DDoS protection for all services. This infrastructure supports Cloudflare’s ability to handle both short-burst swarms and hyper-volumetric attacks. The scale demonstrates Cloudflare’s role as a critical defender of global internet infrastructure.
More than 800 networks use Cloudflare’s DDoS Botnet Threat Feed to identify and takedown abusive IP addresses linked to botnet attacks. The feed provides real-time data on abusive IP addresses and accounts to support coordinated botnet takedowns. The feed leverages Cloudflare’s global network visibility to support collaborative botnet cleanup efforts. The DDoS Botnet Threat Feed and Cloudflare Radar serve as collaborative tools for defenders.
Cloudflare Radar offers a continuously updated view of global DDoS attack trends and transparency into evolving threat landscapes. The tool supports real-time monitoring of attack patterns, helping defenders and researchers track shifts in tactics and infrastructure. “Cloudflare’s network is designed to absorb this kind of growth in DDoS threats,” the company said.
Join the discussion