Cloudflare’s recent findings have brought to light a significant trend in cybersecurity threats, with the company blocking an average of over 8,200 network-layer Distributed Denial of Service (DDoS) attacks every hour during Q3 2026. This frequency highlights a shift in attack strategies, where perpetrators prefer frequent, short bursts over massive traffic floods to disrupt online services.
Quarterly Insights on Network Security
The DDoS Threat Report from Cloudflare, compiled by the Cloudforce One intelligence team, reveals that between July and September, the company thwarted 18.2 million network-layer attacks and filtered 14.4 trillion malicious HTTP requests. These figures emphasize the separation of network-layer attacks from HTTP-based threats, underscoring the diverse tactics employed by attackers.
Cloudflare’s network handled 272.6 petabytes of network-layer traffic and an additional 95.1 petabytes related to HTTP attacks. This data, although confined to Cloudflare’s infrastructure, illustrates the immense volume of malicious traffic managed by its systems.
Understanding the Attack Patterns
Compared to the same period in 2025, network-layer attacks surged by 208%. Notably, 96% of these attacks concluded within ten minutes, with 98% remaining under one gigabit per second. Such levels can still incapacitate unprotected websites or servers, highlighting the importance of robust defenses.
This pattern is attributed to DDoS-for-hire services, commonly known as booters, which enable customers to initiate attacks on demand. Industries like software, gambling, and IT are frequently targeted, presenting a challenge for defenders to automate detection and response to these rapid attacks.
Shifts in Attack Techniques and Locations
There was a significant reduction in attacks exceeding one terabit per second, dropping from 805 in Q2 to 251 in Q3, a decrease likely linked to prior law enforcement actions. In March, the U.S. Justice Department dismantled infrastructure associated with notorious botnets, disrupting operations of entities like Aisuru and KimWolf.
Despite these efforts, Mirai botnet activity persisted, with one attack lasting nearly 50 hours in August. Changes in attack methods were observed, with a 99.5% decrease in CLDAP reflection attacks, while DNS amplification incidents rose by 215%, reflecting an adaptation in tactics.
The United States emerged as the most frequently attacked nation, surpassing China, with Indonesia and Canada also seeing significant increases in attacks. Media and publishing industries remained prime targets, although the diversity of attacked sectors widened to include internet businesses and consumer services.
Cloudflare continues to expand its protective network, operating in over 330 cities with a capacity of 500 Tbps. As AI technology accelerates the speed and reduces the cost of cyberattacks, the necessity for advanced, automated defenses becomes more pressing to counter both brief and sustained assault patterns.
