Cloudflare's Cloudforce One threat intelligence team has released its 26th DDoS Threat Report, covering July through September 2026 and marking a return to quarterly publication after a combined first-half 2026 report. The analysis draws on data collected across Cloudflare's global network to document shifts in the distributed denial-of-service threat landscape.
Key insights
- Attacks under 10 minutes and 1 Gbps in size jumped 208%, while assaults exceeding 1 Tbps fell nearly 69% from the previous quarter—a likely consequence of law enforcement takedowns of four major IoT botnets (Aisuru, KimWolf, JackSkid, and Mossad) earlier in 2026. New botnet variants including Dysphoria and Evooo1Bot continue to emerge, underscoring the durability of IoT-based threats.
- Attackers abandoned CLDAP reflection-amplification tactics almost entirely, with such attacks collapsing 99.5% quarter-over-quarter. In response, threat actors shifted to alternative connectionless protocols, driving DNS amplification up 215% and general UDP floods up 122%.
- Attack distribution expanded across industries and regions, with the United States displacing China as the top target. Canada and Israel saw dramatic climbs in attack frequency—jumping 10 and 7 positions respectively—amid geopolitical tensions and domestic events. Media organizations lost their singular focus as targets; consumer services, Internet infrastructure, and adult entertainment sectors now face sustained pressure.
Q3 by the numbers: 8,200 DDoS attacks every hour
During the third quarter, Cloudflare's network autonomously stopped 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests. This translates to roughly 8,226 network-layer attacks per hour, or approximately 197,400 daily—equating to one attack every 0.44 seconds. The mitigated traffic volume reached 272.6 PB at the network layer and 95.1 PB at the HTTP layer.
More swarms, fewer giants
The quarter witnessed a surge in short-duration, mid-range, high-frequency assaults—the hallmark of DDoS-for-hire "booter" services. These campaigns primarily targeted software, gambling and casino, and information technology sectors. Cloudflare mitigated 18.2 million network-layer attacks in Q3 2026, representing a +208% increase year-over-year:
- 96% concluded within 10 minutes
- 98% remained under 1 Gbps—sufficient to cripple many servers and websites
Conversely, hyper-volumetric network attacks surpassing 1 Tbps declined sharply to 251 incidents in Q3 from 805 in Q2, coinciding with early-2026 law enforcement operations that dismantled four of the largest IoT DDoS botnets. Despite these successes, IoT-based botnets remain a persistent high-volume menace as new variants proliferate. Mirai-classified activity peaked in August at 57.23 PB, accounting for 46.5% of all mitigated network-layer bytes in Q3. Four days in August—the 16th, 19th, 23rd, and 25th—each exceeded three petabytes of mitigated traffic. The longest continuous Mirai campaign lasted 49.7 hours between August 19 and 21.
Vector shifts: the collapse of CLDAP and rise of UDP
The quarter's most striking tactical shift involved the near-total abandonment of CLDAP (Connectionless Lightweight Directory Access Protocol) attacks. These assaults exploit public domain controllers on UDP port 389, using forged victim IP addresses to trick servers into reflecting amplified responses. After surging 580% in the first half of 2026, CLDAP attacks plummeted to just 0.05% of all attacks by Q3.
DNS amplification attacks filled the void, climbing 215% to represent 3.43% of network-layer assaults. Like CLDAP, this vector exploits open DNS resolvers through reflection-and-amplification: attackers send spoofed queries that generate large responses directed at targets. General UDP floods accelerated from 14.06% to 31.31% of network-layer attacks. UDP's connectionless nature makes it ideal for volumetric assaults—attackers flood targets with UDP packets to random or specific ports, forcing systems to check for listening applications and respond, thereby exhausting network and compute capacity.
Most-attacked industry
Media, Production & Publishing retained its position as the most-targeted sector in Q3 2026, though its share fell to roughly one-quarter of Q2 levels. Attack focus dispersed across a broader industrial landscape. Internet infrastructure climbed from outside the top 10 to #6, while Consumer Services and Adult Entertainment entered the rankings at #8 and #9.
Most-attacked locations
Geographic surges: Canada and Israel climb the ranks
Canada surged from #16 to #6, driven by attacks targeting its Retail, Telecommunications, Service providers & carriers, and Marketing & advertising sectors, compounding an already tense period of bilateral trade disputes.
Israel advanced 7 positions to #10 following sustained DDoS activity in mid-September. The timing coincided with contentious parliamentary election decisions, the Rosh Hashanah holiday, and a documented surge in hostile cyber warfare targeting the country.
Top 10
The United States held the top position for most-attacked location in Q3 2026, with China at #2 and Indonesia rising to #3 at 2.93% of total attacks. The U.S.-China ranking represents a reversal from the first half of 2026, when China led and the U.S. ranked second, reflecting shifting attacker focus and preferences.
Strengthening global defenses and helping to defend the Internet
Cloudflare's infrastructure is engineered to absorb DDoS threat growth. All services on the network receive free, unmetered DDoS protection deployed across 330+ cities globally, underpinned by 500 Tbps of network capacity. The system operates autonomously, detecting and mitigating attacks without human intervention—a necessity given that most attacks terminate before analysts can respond, and the largest assaults regularly exceed 1 Tbps at rates measured in hundreds per quarter.
To assist hosting providers, cloud platforms, and Internet service providers in identifying and removing abusive IP addresses and accounts launching attacks, Cloudflare provides a free DDoS Botnet Threat Feed for Service Providers. Over 800 networks worldwide subscribe to this feed, enabling collaborative takedowns of botnet infrastructure. For real-time attack trend visibility, Cloudflare Radar offers continuous monitoring.
About Cloudforce One
Cloudforce One operates with the goal of defending the Internet by leveraging telemetry from Cloudflare's global network—which secures more than 20% of web traffic—to conduct threat research and coordinate operational response, protecting critical infrastructure for millions of organizations worldwide.