Cloudflare Q3 DDoS report: short bursts up 208%, terabit attacks down
Serguey Asael Shinder2 min readAttacks are getting smaller and more numerous, according to the 26th edition of Cloudflare's DDoS Threat Report, which covers July, August and September 2026 and returns the series to quarterly publication after a combined first-half volume. The report is produced by Cloudforce One, Cloudflare's threat intelligence team, from traffic on its own network.
Cloudflare says it mitigated 18.2 million network-layer DDoS attacks in the quarter, roughly 8,226 an hour, plus 14.4 trillion malicious HTTP requests. Short bursts under ten minutes and under 1 Gbps rose 208% against the same quarter of 2025, and 98% of network-layer attacks stayed below 1 Gbps. Cloudflare attributes this pattern to DDoS-for-hire booter services.
At the top end the trend reversed. Attacks above 1 Tbps fell to 251 from 805 in the second quarter, which the report links to law enforcement action earlier in 2026 against four large IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. New variants such as Dysphoria keep appearing; Mirai-classified traffic still made up 46.5% of mitigated network-layer bytes, and the longest sustained Mirai attack ran 49.7 hours in August.
The largest shift was in vectors. CLDAP reflection, which had surged in the first half, collapsed to 0.05% of attacks. DNS amplification rose 215% to 3.43% of attacks, and other UDP floods climbed from 14.06% to 31.31%. The United States replaced China as the most-attacked country, Canada moved from 16th to 6th place, and the Internet industry entered the top ten at sixth.
What it means
For operators the practical message is about thresholds: most attacks now sit well under a gigabit and last minutes, below the level at which volumetric alarms or manual response kick in. Closing open DNS resolvers matters again now that attackers have moved to them from CLDAP. All figures describe traffic seen by Cloudflare, not the Internet as a whole.