Cloudflare’s threat intelligence organization, Cloudforce One, has published its 26th DDoS Threat Report, offering a comprehensive look at the evolving landscape of Distributed Denial of Service attacks during the third quarter of 2026. Covering July, August, and September, the report marks a return to the company’s traditional quarterly reporting cadence following a combined volume analysis for the first half of the year. Leveraging telemetry from Cloudflare’s massive global network, the research highlights a staggering volume of automated cyber threats, shifting attack vectors, and changing geographic targets across the digital ecosystem.
During the third quarter of 2026, Cloudflare systems autonomously mitigated 18.2 million network-layer DDoS attacks alongside 14.4 trillion HTTP DDoS requests. Broken down, this massive wave of malicious traffic translates to approximately 8,226 network-layer attacks every single hour, or roughly 197,400 attacks per day. On average, the automated defenses neutralized an attack every 0.44 seconds. In total terms of data volume, the mitigated traffic reached 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer, illustrating the relentless scale of infrastructure-level interference facing modern web properties.
The data reveals a distinct tactical shift in how cyberattacks are being deployed across the internet. Rather than relying heavily on massive, record-breaking bandwidth pipes, threat actors increasingly turned toward short-burst, mid-range, and high-count attack swarms. This operational signature is characteristic of pay-for-play DDoS-for-hire, commonly known as booter services. These frequent, smaller-scale barrages primarily focused their disruptive efforts on computer software companies, the gambling and casino sector, and broader information technology industries. The sheer frequency of network-layer attacks skyrocketed by 208 percent compared to the same three-month period in 2025.
Conversely, network-level hyper-volumetric attacks—defined as those exceeding one terabit per second—experienced a notable downward correction. After surging to 805 incidents during the second quarter of 2026, the number of hyper-volumetric attacks dropped to 251 in the third quarter. Security analysts attribute this decrease partly to significant law enforcement actions earlier in the year that successfully dismantled four of the world’s largest Internet of Things (IoT) DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad.
Despite these high-profile law enforcement disruptions, IoT-based botnets remain a resilient and durable source of high-volume threats. The threat ecosystem continues to churn out dangerous new variants, including malware families such as Dysphoria and Evooo1Bot, which actively recruit compromised routers and connected hardware into relay networks. Traditional Mirai-classified botnet traffic played a dominant role during the quarter, peaking in August at 57.23 petabytes. This single category accounted for 46.5 percent of all mitigated network-layer bytes in Q3. The activity included four distinct days—August 16, 19, 23, and 25—where defenses cleared over three petabytes of traffic per day, anchored by the quarter’s longest sustained Mirai attack, which ran continuously for 49.7 hours between August 19 and August 21.
The quarter also witnessed dramatic shifts in the popularity of specific attack vectors. The most notable downward movement involved Connectionless Lightweight Directory Access Protocol (CLDAP) reflection and amplification attacks. In these schemes, attackers send small queries with a forged victim IP address to public domain controllers over UDP port 389, tricking them into reflecting massive, amplified responses back at the target. After surging by 580 percent quarter-over-quarter during the first half of 2026, CLDAP attacks suffered a near-total collapse, accounting for a mere 0.05 percent of all attacks in the third quarter.
At the same time, other reflection and direct flooding techniques surged to fill the gap. DNS amplification attacks jumped by 215 percent to make up 3.43 percent of all network-layer attacks, utilizing open DNS resolvers in a similar spoofed query pattern. Meanwhile, broader UDP floods climbed sharply from 14.06 percent to 31.31 percent of network-layer attacks. Because the User Datagram Protocol is connectionless and does not require a formal handshake, it serves as a highly efficient vehicle for raw volumetric traffic, forcing target servers to process floods of unsolicited packets that quickly exhaust available computing and network resources.
Industry targeting also shifted during the third quarter. While Media, Production, and Publishing remained the single most targeted industry vertical, its overall share of attacks dropped to roughly a quarter of the levels recorded in the second quarter. Attackers instead distributed their focus across a wider array of sectors. The Internet industry climbed from outside the top ten to land at the sixth position, while Consumer Services and Adult Entertainment also pushed their way into the upper rankings at eighth and ninth place, respectively.
Geographically, the map of targeted locations saw notable turbulence. Canada experienced a significant surge, jumping from the sixteenth position to sixth place globally. This increase was driven by targeted attacks against its retail, telecommunications, service providers and carriers, and marketing and advertising industries amidst an already complex period of trade and regional discussions. Similarly, Israel climbed seven spots to reach the tenth position, driven by sustained DDoS activity in mid-September. That period coincided with contentious domestic political decisions ahead of parliamentary elections and the Rosh Hashanah holiday, alongside a broader, documented increase in hostile cyber warfare operations targeting the region throughout the year.
Overall, the United States remained the most-attacked location in the third quarter of 2026, with China occupying the number two spot and Indonesia rising into the top three with 2.93 percent of total attacks. The prominent positioning of the United States and China mirrors trends from the first half of the year, where China finished first and the United States second, demonstrating how these two digital powerhouses frequently trade positions as attacker preferences and geopolitical tensions evolve.
Cloudflare notes that its global network infrastructure is explicitly architected to absorb this scale of continuous threat activity. Every service operating on the network benefits from free, unmetered DDoS protection deployed across more than 330 cities worldwide, supported by an aggregate network capacity of 500 terabits per second. Because the vast majority of modern DDoS attacks conclude long before a human analyst could review an alert—and because hundreds of terabit-scale attacks continue to occur every quarter—fully automated detection and mitigation systems remain essential to modern cyber defense.
To aid the broader internet ecosystem, Cloudflare continues to share threat intelligence with hosting providers, cloud platforms, and internet service providers through its free DDoS Botnet Threat Feed for Service Providers. Over 800 networks worldwide currently utilize the feed to identify and dismantle abusive IP addresses and compromised accounts. Ongoing insights and real-time visualization of global attack trends remain publicly available via Cloudflare Radar, supporting collaborative defenses across the internet community.
