Cloudflare blocked over 8,200 network DDoS attacks an hour in Q3
Original title: Hackers Launch 8,200 DDoS Attacks Every Hour, Cloudflare’s Latest Report Reveals
Most attacks lasted under ten minutes and stayed below 1 Gbps, while terabit-scale floods fell nearly 69% from the prior quarter.
Cloudflare’s Cloudforce One DDoS Threat Report for July through September 2026 says the company blocked an average of more than 8,200 network-layer DDoS attacks every hour. It stopped 18.2 million network-layer attacks and 14.4 trillion malicious HTTP requests, filtering 272.6 petabytes of network-layer traffic and 95.1 petabytes of HTTP attack traffic. Network-layer attacks rose 208% from the same quarter in 2025. About 96% ended within ten minutes and 98% stayed below 1 Gbps. Cloudflare linked the pattern to DDoS-for-hire services and said automatic filtering is needed because bursts finish before manual response.
Unconfirmed: Cloudflare said the drop in terabit attacks may reflect earlier law enforcement action but did not establish a direct cause.
- Attacks above 1 Tbps fell from 805 in Q2 to 251 in Q3.
- DNS amplification rose 215% and was 3.43% of network-layer attacks; CLDAP reflection fell 99.5%.
- Other UDP floods rose from 14.06% to 31.31% of network-layer attacks.
- The longest Mirai attack lasted 49.7 hours from August 19 to August 21.
- The United States replaced China as the most-attacked location; media remained the top industry.
Impact: Short DDoS bursts can overwhelm unprotected sites and servers
- 1.Use automatic detection and filtering because most attacks end within minutes.
- 2.Service providers can join Cloudflare’s free DDoS Botnet Threat Feed to identify abusive addresses.
- ATT&CK
- T1498 Network Denial of ServiceT1498.002 Reflection AmplificationT1498.001 Direct Network Flood
- Vendors
- Cloudflare
- Organizations
- U.S. Department of Justice
From the original article
3 min read at cybersecuritynews.com
Cloudflare blocked an average of more than 8,200 network-layer DDoS attacks every hour during the third quarter of 2026, showing how attackers are using frequent, short bursts to disrupt online services rather than relying only on record-breaking traffic floods. The company’s latest DDoS Threat Report, produced by its Cloudforce One threat intelligence team, covers July […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.