Cloudflare: DDoS attacks triple, but now they're swarms lasting under 10 minutes

Cloudflare published its DDoS threat report for the third quarter of 2026, and the headline fits in one sentence: there are far more attacks, but they're smaller and shorter. In July, August, and September, its network mitigated 18.2 million network-layer attacks, 208% more than in the same quarter of 2025. 96% lasted less than 10 minutes and 98% stayed below 1 Gbps. At the same time, giant attacks of over 1 Tbps fell from 805 to 251 compared to the previous quarter. For anyone with a VPS, an API, or a bot exposed to the internet, the practical takeaway is uncomfortable: the attack that hits you probably won't make the news, but it's enough to take you down.

The quarter in numbers

According to Cloudforce One, Cloudflare's threat intelligence team, these are the figures for the quarter:

18.2 million network-layer DDoS attacks and 14.4 trillion malicious HTTP requests mitigated.
About 8,226 attacks per hour, close to 197,400 per day: one every 0.44 seconds.
272.6 PB of traffic mitigated at the network layer and 95.1 PB at the HTTP layer.

The report also marks a return to the quarterly cadence: the previous edition lumped together the whole first half of 2026.

More swarms, fewer giants

Cloudflare describes short, medium-volume, very numerous attacks as the "operational signature" of DDoS-for-hire services, the so-called booters. This quarter they mainly targeted software companies, gambling and casinos, and information technology. And Cloudflare stresses something worth tattooing on your arm: less than 1 Gbps is "more than enough" to knock over a server or a website.

Infographic with the figures from Cloudflare's Q3 2026 DDoS report: drop in attacks over 1 Tbps from 805 to 251, collapse of CLDAP, increase in DNS amplification and UDP floods, and profile of the typical attack

On the other side, hyper-volumetric attacks plunged about 69%. Cloudflare says the drop coincides with the March 2026 law enforcement operation that dismantled four of the largest IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad. The US Department of Justice reported on March 19 that their command-and-control infrastructure was taken down, in coordination with actions in Canada and Germany. According to the DOJ, those botnets had infected more than three million devices (video recorders, webcams, and WiFi routers), sold access as a service, and launched attacks of around 30 Tbps.

But nobody should pop the champagne yet. Cloudflare warns that IoT botnets remain a durable threat because new variants keep emerging, such as Dysphoria and Evooo1Bot. Traffic classified as Mirai reached 57.23 PB in August and accounted for 46.5% of all bytes mitigated at the network layer in the quarter. There were four days in August (the 16th, 19th, 23rd, and 25th) when each surpassed three petabytes, and the longest Mirai attack lasted 49.7 hours, between August 19 and 21.

Attackers switched vectors

The biggest technical shift was in reflection and amplification attacks, where the attacker spoofs the victim's IP and makes a third-party server respond with much more traffic than it received:

Vector	What happened in Q3
CLDAP (UDP 389)	Fell 99.5% versus the previous quarter; now only 0.05% of attacks
DNS amplification	Rose 215% and reached 3.43% of network-layer attacks
Other UDP floods	Went from 14.06% to 31.31% of network-layer attacks

The CLDAP case is curious: in the first half it had grown 580% and then practically vanished. Attackers moved to other connectionless protocols, especially DNS, which works the same way: small queries with a spoofed IP sent to open resolvers and large responses aimed at the victim.

Who's getting hit

By country: The United States regained first place and China came in second, the reverse of the first half. Indonesia entered third place with 2.93% of attacks.
Big jumps: Canada rose from 16th to 6th, with attacks against commerce, telecommunications, service providers, and marketing. Israel rose seven places to tenth due to sustained activity in mid-September.
By industry: media, production, and publishing remain in first place, but with a quarter of their weight from the previous quarter. Internet (6), consumer services (8), and adult entertainment (9) entered the top 10.

The report doesn't break out figures for Mexico or Latin America.

What to do about it

This comes from Cloudflare's official documentation; I didn't test it for this article.

Assume nobody will see the attack. Cloudflare says it flat out: most attacks end before an analyst manages to see the alert. If your defense depends on someone waking up and changing something by hand, you're already too late. Mitigation has to be automatic and upstream of your server.
If you use a proxy like Cloudflare, lock down the origin. Its documentation recommends blocking all HTTP and HTTPS traffic that doesn't come from its IP ranges, because if someone discovers your server's real IP (through old DNS records or your email setup) they bypass all the protection.
Consider not having a public IP at the origin. On October 30, Cloudflare announced general availability of its private origins service: a proxied DNS record points to a private IP and Cloudflare reaches it through a Cloudflare One connection, without opening inbound ports. It has limitations; for example, it doesn't support Argo Smart Routing.
Don't be part of the problem. DNS amplification lives off open resolvers. If you run a recursive DNS, make it respond only to your own networks. My take is that the same applies to any UDP service that doesn't need to be exposed, like a domain controller with port 389 open to the internet.
If you're a hosting provider or ISP, Cloudflare offers its DDoS Botnet Threat Feed for free: you authenticate your ASN with PeeringDB and through the API you receive the IPs in your network that took part in HTTP attacks, with two weeks of history. According to the report, more than 800 networks are already signed up.

My take

This needs to be read with two asterisks. The first: it's a report from a company that sells DDoS protection and only sees what passes through its network, although that network, according to Cloudflare itself, protects more than 20% of the web. The second: giant attacks dropping after a raid doesn't mean the problem is over, just that the market reshuffled. Booters sell short, cheap attacks because they work against the typical target, which isn't a bank with a 24/7 operations center, but the 1 GB VPS someone runs their store, their bot, or their site on. Ten minutes of downtime at peak hour hurts just the same even if the attack doesn't break any record.