Cloudflare mitigated approximately 8,200 DDoS attacks every hour across its network in the third quarter of 2026, revealing a sustained and escalating barrage against online infrastructure. While hyper-volumetric attacks exceeding 1 Tbps declined sharply following law enforcement disruption of major IoT botnets, attackers demonstrated rapid adaptation by shifting tactics. This is evidenced by a 99.5% collapse in CLDAP floods and a corresponding surge in DNS and UDP amplification attacks. The quarter also saw a notable change in targeting, with the United States surpassing China as the most-attacked country.
Shift to Smaller Swarms, Decline of Hyper-Volumetric Attacks
The volume of distributed denial-of-service attacks has shifted markedly, with Cloudflare autonomously mitigating 18.2 million network-layer DDoS attacks in the third quarter of 2026, a 208% increase from the same period in 2025. This surge isn’t driven by larger, headline-grabbing attacks, but by a proliferation of short-burst, low-bandwidth attacks lasting under 10 minutes and peaking below 1 Gbps, indicating a rise in activity from “booter” or DDoS-for-hire services.
These smaller attacks, while individually less potent, collectively represent a constant barrage against online services, targeting industries like computer software, gambling and information technology. A significant decline in hyper-volumetric attacks, those exceeding 1 Tbps, coincided with this increase in smaller swarms, falling to 251 incidents in Q3 from 805 in Q2. This reduction likely stems from law enforcement disruption of four major Internet of Things botnets earlier in the year: Aisuru, KimWolf, JackSkid and Mossad.
While these takedowns proved effective in curbing the largest attacks, the threat landscape remains dynamic, with variants continuing to emerge and IoT botnets proving to be a persistent, high-volume source of malicious traffic. The network-level mitigation data reveals that 96% of attacks ended in under 10 minutes. 98% stayed under 1 Gbps, more than enough to overwhelm a server or website. Attackers have also demonstrated a clear adaptability in their tactics, dramatically shifting their reflection and amplification methods.
The shift in attack vectors is a clear indication of attackers’ willingness to abandon previously favored methods when they become less effective, Cloudflare says. “The most dramatic vector shift of the quarter was downward,” the report states, referring to the CLDAP collapse.
This tactical flexibility highlights the importance of layered defenses capable of responding to a diverse range of attack types and constantly evolving techniques. Cloudflare’s network, with its 330-plus cities globally and 500 Tbps of network capacity, is designed to absorb this growth in DDoS threats and provide free, unmetered DDoS protection to all services on its network.
Geopolitical Shifts Impact DDoS Targets: Canada and Israel
Canada and Israel both registered substantial increases in distributed denial-of-service (DDoS) attack targeting during the most recent quarter, climbing the rankings of most-attacked locations as they navigated complex geopolitical and domestic challenges. Canada ascended from 16th to 6th place, absorbing attacks primarily directed at its retail, telecommunications, service provider, and marketing sectors, while Israel rose seven positions to 10th amid parliamentary elections and heightened cyber warfare documented throughout the year.
The overall volume of network-layer DDoS attacks remained exceptionally high, with Cloudflare autonomously mitigating approximately 8,200 attacks every hour throughout the third quarter of 2026, equivalent to roughly 197,400 attacks per day. While the sheer number of attacks continued at a rapid pace, a notable change occurred in their characteristics, with a move away from massive, single-source volumetric attacks toward a greater prevalence of smaller, more frequent “swarm” attacks.
The United States surpassed China as the most-attacked location in the third quarter of 2026, with Indonesia rising to third place, further demonstrating a dynamic and evolving threat landscape.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
