---
title: Cloudflare Q3 2026 DDoS report: 18.2 million network-layer attacks (+208% year on year), almost all short and small, while 1 Tbps+ attacks fell from 805 to 251 after this year's IoT botnet takedowns | ctxsec
url: https://ctxsec.com/items/cloudflare-ddos-report-q3-2026-short-bursts-up-tbps-down
description: ""
status: "vendor data (Cloudflare Cloudforce One, Oct 29)"
published: 2026-10-29
---

> 

[← Industry News](/industry) · [markdown](/items/cloudflare-ddos-report-q3-2026-short-bursts-up-tbps-down.md)

vendor data (Cloudflare Cloudforce One, Oct 29)

2026-10-29

### Cloudflare Q3 2026 DDoS report: 18.2 million network-layer attacks (+208% year on year), almost all short and small, while 1 Tbps+ attacks fell from 805 to 251 after this year's IoT botnet takedowns

- **Volume:** 18.2 million network-layer attacks (about 8,200 an hour) and 14.4 trillion HTTP DDoS requests mitigated. 96% ended within 10 minutes and 98% stayed under 1 Gbps, the signature of booter services, which is still enough to knock over an unprotected server.
- **Giants:** hyper-volumetric attacks dropped about 69% quarter on quarter, which Cloudflare links to the early-2026 takedown of the Aisuru, KimWolf, JackSkid and Mossad botnets. New IoT families (Dysphoria, Evooo1Bot) keep appearing; Mirai-class traffic was 46.5% of mitigated network bytes, with a 49.7-hour attack Aug 19 to 21.
- **Vectors:** CLDAP reflection collapsed 99.5% while DNS amplification rose 215% and generic UDP floods 122%.
- **Targets:** the U.S. became the most attacked country again; Canada and Israel jumped 10 and 7 places.

**Take:** sub-10-minute bursts often end before a human or an on-demand scrubbing service reacts, so mitigation needs to be always-on and automatic.

Sources: [Cloudflare: DDoS Threat Report 2026 Q3, more swarms, fewer giants (Oct 29)](https://blog.cloudflare.com/ddos-threat-report-2026-q3/)