Quarterly cadence resumes for Q3 2026

Cloudflare's 26th DDoS Threat Report covers July through September 2026, returning to a quarterly schedule after the combined H1 2026 edition. Cloudforce One, Cloudflare's threat intelligence organization, produces the analysis from telemetry collected across the Cloudflare network.

Volume: 8,200 attacks per hour

Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests during the quarter. That averages out to roughly 8,226 network-layer attacks per hour — about 197,400 per day, or one every 0.44 seconds. Mitigated traffic came to 272.6 PB at the network layer and 95.1 PB at the HTTP layer.

Small attacks multiply while terabit floods recede

The quarter's dominant pattern was a high count of short-burst, mid-range attacks, the signature of DDoS-for-hire "booter" services. These campaigns mainly hit computer software, gambling and casinos, and information technology. Network-layer mitigations rose 208% against the same quarter of 2025, and within that volume 96% of attacks ended in under 10 minutes while 98% stayed below 1 Gbps — still sufficient to knock a server or website offline.

Hyper-volumetric network-layer attacks above 1 Tbps moved in the opposite direction, falling to 251 in Q3 from 805 in Q2. The decline coincides with law enforcement action in early 2026 that dismantled four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad. IoT botnets nonetheless remain a durable high-volume threat, with new variants such as Dysphoria and Evooo1Bot appearing.

Mirai-classified mitigation peaked in August at 57.23 PB, or 46.5% of all mitigated network-layer bytes for the quarter. Four days — August 16, 19, 23, and 25 — each cleared three petabytes. The longest sustained Mirai attack ran 49.7 hours, from August 19 to August 21.

Vector shift: CLDAP collapses, DNS and UDP rise

CLDAP (Connectionless Lightweight Directory Access Protocol) floods showed the sharpest movement of the quarter, and it was downward. The vector had surged 580% quarter-over-quarter in the first half of 2026 before dropping to just 0.05% of attacks in Q3. CLDAP abuse works by sending small queries with a forged victim IP to public domain controllers on UDP port 389, which reflect large amplified responses at the target.

Attackers pivoted toward other connectionless protocols. DNS amplification climbed 215% to reach 3.43% of all network-layer attacks, exploiting open DNS resolvers in the same pattern of small spoofed queries and large replies aimed at the victim. General UDP floods grew from 14.06% to 31.31% of network-layer attacks; because UDP is connectionless, it serves as a convenient carrier for raw volumetric traffic, forcing targets to check for listening applications and respond.

Targets spread across industries

Media, Production & Publishing held the top spot among attacked industries in Q3 2026, but its share is roughly a quarter of its Q2 level, and attention has dispersed. Internet infrastructure entered the ranking from outside the top 10 to reach #6, while Consumer Services and Adult Entertainment climbed to #8 and #9.

Geography: the U.S. retakes first place

The United States was the most-attacked location in Q3 2026, with China at #2; the two countries swapped places relative to H1 2026, when China finished first. Indonesia rose into the top three at 2.93% of total attacks.

Canada jumped from #16 to #6, driven by attacks on its retail, telecommunications, service provider and carrier, and marketing and advertising sectors, against a backdrop of bilateral trade disputes. Israel moved up seven spots to #10 following sustained activity in mid-September, a period that included contentious decisions ahead of parliamentary elections, the Rosh Hashanah holiday, and a documented surge in hostile cyber warfare against the country this year.