Cloudforce One, Cloudflare's threat intelligence team, published its Q3 2026 DDoS threat report on October 29, 2026. Cloudflare detected and mitigated 18.2 million network-layer DDoS attacks on its network from July to September, a 208% increase from the same period a year earlier. Meanwhile, large attacks exceeding 1 Tbps fell about 69%, from 805 in the previous quarter to 251. Overall attack counts are surging even as the very largest attacks decline.
A DDoS (distributed denial-of-service) attack floods servers or networks with traffic from many devices, disrupting service. One thing to note in this report is that the decline in giant attacks and the increase in total attacks use different populations and different comparison periods. In addition, most attacks ended in under 10 minutes, and short attacks are being repeated. Seeing fewer high-bandwidth attacks does not mean the DDoS threat has weakened.
Giant DDoS Attacks Down About 69%, While Total Attacks Rise 208% Year on Year
What stands out in this report is how differently counts changed depending on attack size. According to Cloudflare, network-layer DDoS attacks above 1 Tbps fell from 805 in Q2 2026 to 251 in Q3. The decline is (805 − 251) ÷ 805 × 100, or about 68.8%. Meanwhile, total network-layer DDoS attacks rose 208% year on year to 18.2 million, which is 3.08 times the level of the same period last year.
| Population | Comparison period | Attack count | Change |
|---|---|---|---|
| Network-layer DDoS attacks above 1 Tbps | Q2 and Q3 2026 | 805 → 251 | Down about 68.8% quarter on quarter |
| All network-layer DDoS attacks | Q3 2025 and Q3 2026 | 18.2 million in Q3 2026 | Up 208% year on year (3.08x) |
When comparing these two figures, take care not to confuse a drop in the number of attacks above 1 Tbps with individual attacks getting smaller. The roughly 69% decline compares the number of attacks that exceeded 1 Tbps; it does not mean the largest attacks became 69% smaller. The 208% rise in the total is also a year-on-year comparison, not a change from the previous quarter.
Furthermore, these statistics are limited to attacks that Cloudflare detected and mitigated on its own network. They are not the total number of DDoS attacks occurring across the entire internet, nor the number of attacks that actually caused outages or other harm. Changes in attack counts cannot be directly tied to changes in damage or defense costs. To understand the real threat, it is also necessary to look at attack duration, traffic volume and the methods used.
96% of DDoS Attacks Last Under 10 Minutes, and 98% Stay Below 1 Gbps
Cloudflare observed that 96% of network-layer DDoS attacks ended in under 10 minutes, and 98% stayed below 1 Gbps in bandwidth. Even as attack counts surged, the vast majority were short and relatively small. However, 96% and 98% are results tallied separately for duration and bandwidth; they do not mean that 96% of attacks were both under 10 minutes and under 1 Gbps. The exact share of attacks meeting both conditions cannot be determined from these two figures alone.
Cloudflare describes this pattern of short, small, high-frequency attacks as characteristic of DDoS-for-hire services. These services let users pay to access attack infrastructure, and they can also be used to launch repeated short attacks. That said, not every attack observed was identified as coming from a DDoS-for-hire service. Cloudflare points to the similar size and duration of the attacks as suggesting that use of such services may be growing.
More short attacks change what defense requires. Against attacks that send large volumes of traffic for a long time, there may be time to respond after an anomaly is detected. But when attacks that end within minutes are repeated, a process in which a human operator checks an alert and then responds is likely to be too slow. Beyond peak bandwidth, attack duration, frequency and the time from detection to mitigation are important in evaluating defensive capability.
Cloudflare also reported mitigating 14.4 trillion HTTP-layer DDoS requests in the same quarter. However, that figure counts HTTP requests, whereas the 18.2 million network-layer figure counts the DDoS attacks themselves. Because the units differ, the two cannot be added together as a total number of attacks, and the scale of the threat cannot be compared by the size of the numbers alone.
Botnet Crackdowns and Shifts in Attack Methods
Cloudflare cites large-scale law enforcement action against botnets in early 2026 as a possible factor behind the decline in DDoS attacks above 1 Tbps. The targets were four IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. They are known as large networks that harness many devices for attacks, and Cloudflare says the crackdown dismantled their operating base. However, the fact that the timing of the crackdown overlaps with the decline in giant attacks does not prove a causal link.
Even when existing botnets are taken down, new attack infrastructure keeps emerging. The report describes activity by new botnets such as Dysphoria and Evooo1Bot, so the threat of large-scale attacks abusing IoT devices remains. Among attacks classified as Mirai, one lasted 49.7 hours, from August 19 to 21. This was the longest-running Mirai-classified attack reported this time, not the longest DDoS attack of any kind. While most attacks end in under 10 minutes, attacks lasting days continue to occur.
Attack methods also shifted significantly. Most notable was the sharp drop in attacks abusing CLDAP (Connectionless Lightweight Directory Access Protocol). CLDAP attacks fell 99.5% from the previous quarter and accounted for only 0.05% of all network-layer DDoS attacks in Q3. DNS amplification attacks, by contrast, rose 215% from the previous quarter and made up 3.43% of the total. This suggests attackers may be switching the communication protocols they use.
CLDAP attacks and DNS amplification attacks share a mechanism known as reflection and amplification. The attacker spoofs the victim's IP address as the source and sends small queries to third-party servers. Those servers send larger responses to the spoofed source, so a flood of traffic converges on the victim. The attacker can amplify attack traffic using third-party servers without sending large amounts of data themselves.
CLDAP attacks abuse servers such as domain controllers that accept external queries on UDP port 389. DNS amplification attacks, on the other hand, send queries to externally accessible DNS resolvers and similar servers, causing them to return large DNS responses to the victim. The servers and protocols differ, but both rely on spoofed source IP addresses and amplified responses. A sharp drop in CLDAP attacks therefore does not mean the threat from reflection and amplification attacks as a whole has weakened.
Changes are also under way across UDP-based attacks. Among UDP floods, which send large numbers of UDP packets at a target, the share of attacks classified as "other" rose from 14.06% in the previous quarter to 31.31% in Q3. Because UDP does not require establishing a connection with the other party, it is easily abused for attacks that send large numbers of packets in a short time. However, the change from 14.06% to 31.31% is a change in share of all attacks and does not directly represent the growth rate in attack counts.
These results suggest that even when a particular attack method declines, attackers may move to another. In particular, the surge in DNS amplification attacks and the rising share of UDP floods suggest that network-layer DDoS defenses need to handle a wide range of traffic patterns. However, these statistics alone cannot determine whether the shift in attack methods was caused by any particular crackdown.
As Short Attacks Increase, Speed of Automated Detection and Mitigation Matters
Another challenge highlighted by this report is the speed of response to DDoS attacks. Cloudflare says its network detects and mitigates attacks automatically, without human intervention. It also notes that many of the attacks observed this time ended before a human security operator could review an alert. Given that 96% of attacks end in under 10 minutes, systems that rely on manual handling after an anomaly is detected may struggle to provide adequate defense in some situations.
That said, this is Cloudflare's description of its own defensive capabilities and does not guarantee that every attack will be fully blocked or that service outages will be avoided. The report also does not provide statistics comparing the time from detection to mitigation across all attacks, nor changes in the staffing or costs needed for defense. The attack trends support the need for automation, but the specific effectiveness of defenses must be evaluated separately.
For service operators, what matters is not only peak attack bandwidth but also whether they can detect and mitigate fast enough when short attacks are repeated. They also need to handle shifts in methods, such as the move from CLDAP to DNS amplification. The shorter the time until an attack ends, the more any delay in detection or mitigation can affect service availability, making the response speed of defense systems and continuous monitoring important.
Cloudflare's Q3 2026 observations show that a decline in large DDoS attacks does not necessarily mean the overall threat is receding. Attacks above 1 Tbps fell about 69%, but network-layer attack counts rose more than threefold from a year earlier, and short attacks and shifting methods continue. Going forward, it will be necessary to keep watching not only the number of giant attacks but also the speed of automated detection and mitigation and trends in DNS amplification attacks and UDP floods. Whether the effect of the crackdowns proves temporary or leads to long-term changes in attack scale and methods will also be a key point to watch in the coming quarters.