Swarms Over Giants! Cloudflare's DDoS Threat Report for 2026 Q3

Hi everyone, it's Shii-chan!

blog.cloudflare.com

Cloudflare just published its DDoS threat report for 2026 Q3. It's packed with numbers, so let's dig in!

What was announced?

On the Cloudflare Blog, the 26th edition of the DDoS Threat Report is out. It covers July through September 2026 and comes from Cloudforce One, Cloudflare's threat intelligence team. It returns to quarterly reporting after a combined H1 2026 edition.

The title is "More swarms, fewer giants": fewer huge attacks, more swarms of small ones.

Why it matters

DDoS coverage often focuses on sheer size, but this report shows how the shape of attacks is changing.

Earlier in 2026, law enforcement action dismantled several large IoT botnets. The numbers show how attack patterns shifted afterward.

What changes

Defenders need to plan for short, high-frequency attacks, not only giant ones.

96% of attacks ended in under 10 minutes
98% stayed under 1 Gbps
So manual response can't keep up, and automated detection and mitigation is the baseline

Cloudflare says detection and mitigation run without human intervention.

Dive Deep

Q3 at a glance

Network-layer DDoS attacks mitigated: 18.2 million
HTTP DDoS requests mitigated: 14.4 trillion
About 8,226 network-layer attacks per hour, or one roughly every 0.44 seconds
Mitigated traffic: 272.6 PB at the network layer and 95.1 PB at the HTTP layer

Attack size and duration

Attacks under 10 minutes and 1 Gbps rose 208%
Hyper-volumetric attacks (over 1 Tbps) fell from 805 in Q2 to 251 in Q3, down nearly 69%
The report applies the 208% increase both to short-burst attacks and to the 18.2 million total, so the exact scope of that figure is unclear

Botnets

Early 2026 law enforcement action dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad. The report links this to the drop in hyper-volumetric attacks
New variants such as Dysphoria and Evooo1Bot show IoT botnets remain a threat
Mirai-classified mitigation peaked in August at 57.23 PB, or 46.5% of all Q3 network-layer bytes
The longest Mirai attack lasted 49.7 hours, from August 19 to 21

Shifting attack vectors

CLDAP floods rose 580% in H1, then fell 99.5% quarter-over-quarter to 0.05% of attacks in Q3
DNS amplification rose 215% to 3.43% of network-layer attacks
General UDP floods rose 122%, from 14.06% to 31.31%

Attackers seem to be moving from CLDAP reflection to other connectionless protocols.

Targeted industries and locations

Booter-style attacks (short, mid-range, high-count) mainly hit computer software, gambling and casinos, and IT
Media, Production & Publishing stayed #1, but its share was about a quarter of its Q2 level
Internet jumped from outside the top 10 to #6, Consumer Services reached #8, and Adult Entertainment reached #9
By country, the United States returned to #1, China was #2 (it was #1 in H1 2026), and Indonesia entered the top three at 2.93%
Canada rose from #16 to #6, and Israel rose 7 spots to #10

Cloudflare's defenses

Free, unmetered DDoS protection in more than 330 cities
500 Tbps of network capacity
Attacks above 1 Tbps still happen in the hundreds per quarter
Over 800 networks have signed up for the free Botnet Threat Feed

Wrap-up

Q3 saw 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests mitigated
96% of attacks lasted under 10 minutes and 98% stayed under 1 Gbps, so attacks are shorter and more frequent
Attacks over 1 Tbps fell from 805 to 251
CLDAP collapsed while UDP floods and DNS amplification grew
New IoT botnet variants are appearing even after the big takedowns

A great read for infrastructure and security operators who want to understand current attack trends!