Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3 2026, Up 38%
Cloudflare's Q3 2026 DDoS Threat Report reveals a dramatic surge in distributed denial-of-service attacks, with 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests mitigated — aver
Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
Cloudflare’s latest DDoS report points to a sharp rise in attack volume in Q3 2026, with the company saying it mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests during the quarter. That works out to roughly one attack every 0.44 seconds, according to the findings cited by The Hacker News on 2026-10-31.
Attack volume kept climbing through 2026
The reported numbers show a quarter-by-quarter increase in network-layer activity, with 10.0 million L3 attacks in Q1, 13.2 million in Q2, and 18.2 million in Q3. The source says Cloudflare’s data indicates DDoS activity rose throughout the year, suggesting attackers were not simply maintaining pressure but accelerating it.
The report also says short-burst attacks lasting under 10 minutes and staying below 1 Gbps surged 208%. At the same time, hyper-volumetric attacks exceeding 1 Tbps declined 69%, falling from 805 in Q2 to 251 in Q3. The source does not explain whether that shift reflects changing attacker behavior, mitigation effects, or other factors.
Boooter services and DNS amplification stand out
According to the report summary, the surge is linked to DDoS-for-hire booter and stresser services. The source describes these services as a driver behind the increase in short, low-bandwidth attacks, but it does not quantify their market share or attribute the rise to any specific provider.
Cloudflare’s findings also say DNS amplification attacks rose 215% and accounted for 3.43% of all network-layer attacks. The report additionally notes new attack variants named Dysphoria and Evooo1Bot, though the source does not provide further technical detail on either variant.
Who was hit most often
The source says the most attacked industries included media, production and publishing, IT and services, gambling and casinos, computer software, and telecommunications. On the geographic side, the most attacked countries were the US, China, Indonesia, the UK, and Turkey.
Those lists indicate where pressure was concentrated, but they do not by themselves show which sectors or countries were most at risk overall. They only reflect the report’s observed attack distribution.
What the report does and doesn’t prove
The available evidence supports a clear conclusion: DDoS activity remained elevated in Q3 2026, with particularly strong growth in brief, low-bandwidth attacks and DNS amplification traffic. It also suggests the overall threat mix may be shifting away from fewer extreme-volume events toward more frequent, shorter bursts.
What the source does not prove is why that shift happened beyond its attribution to booter and stresser services. It also does not establish whether the decline in >1 Tbps attacks represents a temporary dip or a longer-term trend.
Cloudflare’s report, as cited by The Hacker News on 2026-10-31, paints a picture of a faster-moving and more persistent DDoS environment than earlier in the year.
Sources and dates
Research completed: 2026-10-31T05:07:00Z
Affiliate link: we may earn a commission at no additional cost to you. Check current features and terms before signing up.
Building your own website?
This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.
This article may contain affiliate links. If you purchase through them, we may earn a commission at no additional cost to you.