Cloudflare mitigated 18.2M network DDoS attacks in Q3
Cloudflare's Q3 2026 DDoS Threat Report counts 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests, while 1 Tbps+ floods fell sharply after botnet takedowns.
Cloudflare's Q3 2026 DDoS Threat Report, the 26th edition from its Cloudforce One team, says the company autonomously mitigated 18.2 million network-layer (L3/4) DDoS attacks and 14.4 trillion HTTP DDoS requests between July and September. The useful signal this quarter isn't the raw total — it's that the biggest attacks got rarer while the smallest got far more common.
The numbers
- 18.2 million network-layer attacks mitigated in Q3.
- 14.4 trillion HTTP DDoS requests.
- Cloudflare frames the network-layer figure as +208% year over year — but the report attaches the same 208% to short-burst attacks elsewhere, so treat that headline growth number with skepticism. The cleaner trend: the network-layer count ran 13.2 million in Q2, so Q3's 18.2 million is a real quarter-on-quarter rise of roughly a third.
The shift worth noting
Hyper-volumetric attacks fell. Floods exceeding 1 Tbps dropped to 251 in Q3, down from 805 in Q2 — a roughly 69% decline. Cloudflare credits law-enforcement action in early 2026 that dismantled four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad. The report cautions that new IoT botnet variants keep emerging, so the dip is a lull, not a trend reversal.
Short-burst attacks surged. The growth is in attacks under 10 minutes and under 1 Gbps — cheap, fast hits from booter/stresser services aimed at slipping under always-on mitigation thresholds.
Who got hit
- Most-attacked industry: Media, Production & Publishing remained #1.
- Most-attacked countries: United States (#1), China (#2), and Indonesia (#3, at 2.93% of all attacks). Canada and Israel climbed into the top ranks.
Cloudflare's Mirai-classified mitigation peaked in August at 57.23 PB of attack traffic, with one sustained Mirai campaign running 49.7 hours.
What to do today
Treat the report as a calibration check on your own posture, not a reason to buy anything:
- Tune for short, low-rate floods. If your DDoS defense keys on sustained high-bandwidth signatures, the fastest-growing attack class is specifically built to stay beneath that. Verify your provider mitigates sub-Gbps, sub-10-minute bursts without manual intervention.
- Don't bank on the 1 Tbps dip. The decline tracks botnet takedowns, not a drop in attacker intent. Confirm your origin can't be reached directly and that always-on protection — not on-demand — fronts anything internet-facing.
- Media and publishing operators: you remain the top target. Rehearse the runbook.
Context
Vendor threat reports sell the vendor, and DDoS counts especially reward whoever measures the most traffic — so the absolute totals say more about Cloudflare's footprint than about the internet. The directional findings are what hold up across sources: the post-takedown drop in terabit-scale attacks and the migration toward small, disposable floors line up with what other scrubbing providers have described this year. The 208% headline does not reconcile cleanly inside Cloudflare's own report; the per-quarter 13.2M-to-18.2M figures do, and that's the number to cite.