Cloudflare Mitigated 18.2 Million Network-Layer DDoS Attacks in Q3
Cloudflare records 18.2 million L3 attacks in one quarter
Cloudflare said it autonomously mitigated 18.2 million network-layer distributed denial-of-service attacks in the third quarter of 2026, a 38% increase from the 13.2 million recorded in Q2. The web infrastructure and security company also mitigated 14.4 trillion HTTP DDoS requests during the period.
The quarterly volume works out to roughly 197,400 network-layer attacks each day, or one attack every 0.44 seconds. Cloudflare calculated that threat actors were launching about 8,226 such attacks per hour. The Q3 total followed 10.0 million network-layer DDoS attacks reported in Q1 2026 and 13.2 million in the following quarter.
Short bursts and amplification traffic reshape the attack mix
Cloudflare linked the rise in activity to DDoS-for-hire, or booter and stresser, services that were responsible for hundreds of thousands of attacks. Its Cloudforce One threat intelligence team reported a 208% increase in short-burst, low-bandwidth campaigns lasting under 10 minutes and measuring below 1 Gbps.
That pattern matters because a DDoS programme cannot be evaluated solely against the largest headline-grabbing floods. Frequent, smaller events can still disrupt exposed services, trigger operational investigation and test the speed at which traffic controls identify and absorb hostile requests.
The protocol mix also shifted in the quarter. Connectionless Lightweight Directory Access Protocol floods declined, while DNS amplification attacks rose 215% and accounted for 3.43% of all network-layer attacks. DNS amplification uses reflected traffic to increase the volume directed at a target, making the change relevant to teams reviewing which network protocols and upstream controls are exposed.
Largest attacks fall, but new variants remain
Hyper-volumetric attacks above 1 Tbps declined 69% quarter on quarter, falling from 805 in Q2 to 251 in Q3. Cloudflare said this was likely connected to law-enforcement action in March against AISURU, KimWolf, JackSkid and Mossad.
However, Cloudflare said the threat had not been fully neutralized, citing emerging variants named Dysphoria and Evooo1Bot. The most targeted sectors were media, production and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers.
The United States, China, Indonesia, the United Kingdom and Türkiye were the most attacked countries. Canada and Israel entered the top 10, with attacks on Canadian retail, telecommunications and marketing organizations contributing to that position.
Business implication
For businesses, the Q3 figures support testing DDoS readiness for sustained high-volume events and for repeated short bursts, while reviewing DNS amplification exposure and ensuring that escalation procedures can respond at the pace of automated attacks.