Cloudflare mitigated 18.2 million (1.82 crore) network-layer distributed denial-of-service attacks during the third quarter of 2026, marking a sharp increase from the previous quarter as attackers increasingly relied on short, low-bandwidth bursts and DDoS-for-hire services.
The web infrastructure and cybersecurity company said it also blocked 14.4 trillion HTTP DDoS requests during the quarter. That translates to about 197,400 network-layer attacks every day, or roughly 8,226 attacks every hour.
Cloudflare said the pace amounted to approximately one network-layer DDoS attack every 0.44 seconds.
The Q3 figure represents a significant rise from the 13.2 million Layer 3 DDoS attacks recorded in the second quarter and the 10 million logged in the first quarter of 2026.
Short-Burst DDoS Attacks Rise Sharply
One of the most notable changes during the quarter was the growth of short-duration, low-bandwidth attacks.
Cloudflare said attacks lasting less than 10 minutes and measuring below 1 Gbps increased by 208 per cent.
These attacks can be difficult to manage because they may begin and end before manual defensive measures can be deployed, increasing the importance of automated detection and mitigation systems.
Cloudflare linked part of the broader increase in DDoS activity to booter and stresser services, which allow customers to launch attacks against online targets for a fee.
Such DDoS-for-hire services have been associated with hundreds of thousands of attacks and continue to lower the technical barrier for launching disruption campaigns.
Despite enforcement action against several major botnets and attack services, Cloudflare said new infrastructure and variants continue to emerge.
Hyper-Volumetric Attacks Fall 69%
While the overall number of attacks increased, the largest hyper-volumetric attacks became less common during the quarter.
Cloudflare recorded 251 attacks exceeding 1 Tbps in Q3, down from 805 during the second quarter.
That represents a decline of about 69 per cent.
The company said the reduction may be linked to law enforcement action earlier in the year against major botnets and malicious infrastructure associated with campaigns such as AISURU, KimWolf, JackSkid and Mossad.
However, Cloudflare warned that the decline does not mean the threat has disappeared.
New variants, including Dysphoria and Evooo1Bot, have emerged, demonstrating how quickly the DDoS ecosystem can adapt following disruption efforts.
The shift suggests that while some of the most extreme attacks may have declined, attackers are increasingly favouring large numbers of smaller, rapid campaigns.
DNS Amplification Attacks Jump 215%
Cloudflare also reported a significant change in the techniques used by attackers.
Connectionless Lightweight Directory Access Protocol, or CLDAP, flood attacks declined during the quarter.
In contrast, DNS amplification attacks increased by 215 per cent and accounted for 3.43 per cent of all network-layer DDoS attacks.
DNS amplification attacks typically exploit publicly accessible DNS servers to generate much larger volumes of traffic than the attacker originally sends.
By spoofing the victim’s address, attackers can cause servers to direct large amounts of response traffic towards a target, overwhelming its network resources.
The sharp increase indicates that amplification techniques remain an important part of the DDoS landscape despite years of defensive efforts and awareness.
Media, IT and Telecom Among Most Targeted Sectors
Cloudflare identified several industries that faced particularly high levels of DDoS activity during the quarter.
Media, production and publishing organisations were among the most targeted, followed by information technology and services companies.
Gambling and casino businesses, computer software providers and telecommunications companies were also heavily targeted.
These sectors often depend on continuous online availability, making disruption particularly damaging to operations, revenue and customer access.
Telecommunications and technology companies can also be attractive targets because attacks against their infrastructure may affect large numbers of downstream users.
US and China Among Most Attacked Countries
The United States, China, Indonesia, the United Kingdom and Türkiye ranked among the most heavily targeted countries during Q3.
Canada and Israel also entered the top 10.
Cloudflare said Canada’s rise was driven in part by attacks targeting its retail, telecommunications and marketing sectors.
The geographic spread of attacks highlights the global nature of DDoS activity, with attackers targeting organisations across industries and regions rather than concentrating on a single market.
The Q3 figures also show that DDoS activity continues to evolve in both scale and technique.
Although the number of attacks exceeding 1 Tbps declined significantly, the broader volume of network-layer attacks continued to climb, while shorter and smaller attacks became considerably more frequent.
For organisations, the trend reinforces the importance of automated mitigation systems capable of reacting within seconds, particularly as attackers increasingly favour rapid campaigns that may be difficult to counter through manual intervention alone.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
