Cloudflare Q3 2026 DDoS report: 18.2 million network-layer attacks (+208% year on year), almost all short and small, while 1 Tbps+ attacks fell from 805 to 251 after this year's IoT botnet takedowns
- Volume: 18.2 million network-layer attacks (about 8,200 an hour) and 14.4 trillion HTTP DDoS requests mitigated. 96% ended within 10 minutes and 98% stayed under 1 Gbps, the signature of booter services, which is still enough to knock over an unprotected server.
- Giants: hyper-volumetric attacks dropped about 69% quarter on quarter, which Cloudflare links to the early-2026 takedown of the Aisuru, KimWolf, JackSkid and Mossad botnets. New IoT families (Dysphoria, Evooo1Bot) keep appearing; Mirai-class traffic was 46.5% of mitigated network bytes, with a 49.7-hour attack Aug 19 to 21.
- Vectors: CLDAP reflection collapsed 99.5% while DNS amplification rose 215% and generic UDP floods 122%.
- Targets: the U.S. became the most attacked country again; Canada and Israel jumped 10 and 7 places.
Take: sub-10-minute bursts often end before a human or an on-demand scrubbing service reacts, so mitigation needs to be always-on and automatic.
Sources: Cloudflare: DDoS Threat Report 2026 Q3, more swarms, fewer giants (Oct 29)