By 
Cloudflare reported that it mitigated 18.2 million network-layer distributed denial-of-service attacks during the third quarter of 2026, highlighting the continued pressure that automated attack campaigns are placing on internet infrastructure. The findings were published in the company’s Q3 DDoS Threat Report on October 29, making this a recent industry development rather than a new disclosure on November 4.
The report points to a changing pattern in attack activity. Instead of relying only on exceptionally large traffic floods, attackers increasingly used shorter, lower-bandwidth campaigns that can still overwhelm individual services and network resources.
Shorter Attacks Are Becoming More Common
Cloudflare said short-burst attacks lasting less than 10 minutes and staying below 1 Gbps increased by 208% compared with the same quarter a year earlier. These campaigns are often associated with DDoS-for-hire services, which allow attackers to launch repeated disruptions without operating their own large infrastructure.
The company recorded approximately 8,226 network-layer attacks every hour during the quarter, equivalent to around 197,400 per day. It also mitigated 14.4 trillion HTTP DDoS requests, demonstrating the scale of automated traffic that internet-facing services had to absorb.
The increase in smaller campaigns matters because a website or service does not need to experience a terabit-scale attack to become unavailable. Repeated bursts can consume resources, disrupt access and create operational costs for organisations that do not have sufficient protection.
Attackers Are Changing Their Methods
The report also identified a significant shift in the protocols used for reflection and amplification attacks. CLDAP-based activity fell sharply during the quarter, while DNS amplification attacks rose by 215% and general UDP floods increased substantially.
Cloudflare recorded 251 hyper-volumetric network-layer attacks exceeding 1 Tbps in Q3, down from 805 in Q2. The company suggested that law-enforcement action against several major Internet of Things botnets earlier in the year may have contributed to the decline. However, it cautioned that new botnet variants continue to emerge.
Targets and Geography Are Broadening
The report found that attack activity was distributed across a wider range of industries and locations. The United States was the most targeted country, followed by China and Indonesia. Canada and Israel also moved higher in the rankings during the quarter.
Cloudflare said the mix of targeted industries had changed, with internet infrastructure and consumer services featuring more prominently. This broadening of targets reinforces the need for organisations outside traditionally high-risk sectors to maintain effective DDoS protection.
What Organisations Should Take From the Findings
The report underlines that DDoS defence cannot focus exclusively on record-breaking traffic volumes. Short, repeated attacks may be less dramatic but can still interrupt services, particularly when they exploit weaknesses in application architecture or network capacity.
For businesses operating online services, the findings strengthen the case for automated traffic monitoring, resilient network design and mitigation arrangements that can respond faster than a manual incident process. Cloudflare’s figures are based on activity observed across its own network, so they should be understood as a large provider’s telemetry rather than a complete count of every DDoS attack worldwide
Comments