Cloudflare Q3 2026 DDoS Report: Short-burst attacks surge, hyper-volumetric attacks decline

Cloudflare Releases Q3 2026 DDoS Threat Report

Cloudflare's latest DDoS Threat Report covers the third quarter of 2026, analyzing data from July, August, and September. The report, compiled by Cloudforce One, Cloudflare's Threat Intelligence organization, provides an analysis of Distributed Denial of Service (DDoS) attack trends based on data collected across the Cloudflare network.

Shifts in Attack Volume and Tactics

The report highlights a significant increase in short-burst, low-bandwidth DDoS attacks, which saw a 208% surge. These attacks typically last under 10 minutes and are less than 1 Gbps. Conversely, hyper-volumetric attacks exceeding 1 Tbps decreased by nearly 69% compared to Q2 2026. This decline may be linked to law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year, though new IoT botnet variants continue to emerge.

Attackers also changed their reflection and amplification tactics. CLDAP floods collapsed by 99.5% quarter-over-quarter. Instead, threat actors pivoted to other connectionless protocols, leading to a 215% surge in DNS amplification attacks and a 122% increase in general UDP floods.

Broadening Attack Targets and Geographic Focus

The scope of attack targets expanded across various industries and geographies. The United States regained its position as the most-attacked country, surpassing China. Canada and Israel experienced notable spikes in targeted attacks, rising 10 and 7 spots respectively, amidst geopolitical tensions and domestic events. The operational focus shifted away from media organizations, with attacks now targeting a wider array of industries including consumer services, internet infrastructure, and adult entertainment.

Q3 2026 Attack Statistics

During Q3 2026, Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests across its network. This translates to approximately 8,226 network-layer DDoS attacks per hour, or about 197,400 per day. The total mitigated traffic for the quarter was 272.6 PB at the network layer and 95.1 PB at the HTTP layer.