Cloudflare: DDoS Attacks Surge 38% in Q3 with Shift to Smaller, Frequent Strikes

Q3 2026 saw a 38% surge in network-layer DDoS attacks, with Cloudflare mitigating 18.2 million incidents compared to 13.2 million in Q2. The company recorded 197,400 attacks per day—or one attack every 0.44 seconds—linked to the proliferation of DDoS-for-hire services. Attack patterns shifted significantly: short-burst assaults lasting under 10 minutes and 1 Gbps surged 208%, while the company also mitigated 14.4 trillion HTTP DDoS requests over the same period.

Hyper-volumetric attacks exceeding 1 Tbps declined sharply, falling 69% to 251 incidents from 805 in Q2. Cloudflare attributed the drop to law enforcement actions against AISURU, KimWolf, JackSkid, and Mossad in March. Yet new threats persist: variants Dysphoria and Evooo1Bot have emerged. DNS amplification attacks jumped 215% to comprise 3.43% of network-layer activity, while CLDAP floods declined. Media, IT services, gambling, software, and telecommunications sectors were the most targeted, with the U.S., China, Indonesia, U.K., and Türkiye experiencing the most attacks. Canada and Israel recently entered the top 10, driven by strikes against retail, telecommunications, and marketing operations.