Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants

What it is

Cloudflare's Cloudforce One report for July to September 2026 gives the attack mix behind the headline counts. Cloudflare mitigated 18.2 million network-layer attacks (about 8,226 per hour) and 14.4 trillion HTTP DDoS requests. That was 272.6 PB of network-layer traffic and 95.1 PB at the HTTP layer.

Details the summary leaves out

• Attack size and length: 96% of network-layer attacks ended in under 10 minutes and 98% stayed under 1 Gbps. Cloudflare calls this the signature of DDoS-for-hire booter services. They mainly hit computer software, gambling and casinos, and information technology.
• Vector mix: other UDP floods rose from 14.06% to 31.31% of network-layer attacks. DNS amplification reached 3.43%. CLDAP (UDP 389, spoofed queries to public domain controllers) fell to 0.05% of attacks after a 580% rise in the first half of 2026.
• Botnets: Mirai-classified traffic peaked in August at 57.23 PB, or 46.5% of all mitigated network-layer bytes in Q3. Four days (16, 19, 23 and 25 August) each cleared 3 PB. The longest Mirai attack ran 49.7 hours, from 19 to 21 August. New variants named are Dysphoria and Evooo1Bot.
• Targets: Media, Production & Publishing is still the top industry, but at roughly a quarter of its Q2 share. Internet rose to #6, Consumer Services to #8 and Adult Entertainment to #9. Canada moved from #16 to #6 (retail, telecoms, service providers, marketing). Israel took #10 on sustained activity in mid-September. The US is #1, China #2, and Indonesia #3 at 2.93%.

What to do

• Provider networks (hosting, cloud, ISP) can use Cloudflare's free DDoS Botnet Threat Feed for Service Providers to find and remove abusive IPs and accounts. The report says over 800 networks have signed up.
• Cloudflare Radar gives a continuously updated view of attack trends.
• The mix suggests checking that open DNS resolvers are not usable for amplification and that rate controls cope with many short, sub-1 Gbps UDP bursts. The page does not state this as advice.

Caveats

• Hyper-volumetric attacks (over 1 Tbps) fell from 805 in Q2 to 251 in Q3. Cloudflare only says this is "possibly" linked to the takedown of Aisuru, KimWolf, JackSkid and Mossad, which it places in early 2026.
• Cloudflare says IoT botnets remain a durable threat and that attacks above 1 Tbps still occur in the hundreds per quarter.
• The page does not explain how the +208% figure is calculated. It is stated as a rise over Q3 2025 in the attack count, and the report does not say whether it applies only to the short, low-bandwidth attacks.
• The figures come from Cloudflare's own network, and the post closes with a pitch for its free, unmetered protection.