Skip to content
NewA calmer, faster ZeroHour
StoryResearchmedium

Cloudflare Q3 2026: more short DDoS attacks, fewer over 1 Tbps

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 30: GBHackers adds Indonesia as the third most-attacked location and says media, production, and publishing stayed the top industry as targeting diversified.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cloudflare’s Q3 2026 report shows a surge in brief, smaller DDoS attacks and a sharp drop in floods above 1 Tbps.

Cloudflare’s Q3 2026 DDoS report, covering July through September and published October 29, says the company mitigated 18.2 million network-layer attacks—about 8,200 an hour—and 14.4 trillion HTTP DDoS requests. About 96% of network-layer attacks ended within 10 minutes and 98% stayed under 1 Gbps. Attacks above 1 Tbps fell from 805 in Q2 to 251, nearly 69%, which Cloudflare links to early-2026 action against the Aisuru, KimWolf, JackSkid, and Mossad IoT botnets. The Cloudflare Blog says short attacks under 10 minutes and 1 Gbps rose 208% year over year; Cyber Security News and GBHackers attribute that 208% rise to network-layer attacks overall. CLDAP reflection fell 99.5% as DNS amplification rose 215%, and the United States was the most-attacked location.

Key facts
  • Mitigated traffic: 272.6 PB network-layer and 95.1 PB HTTP.
  • Mirai-classified mitigation peaked in August at 57.23 PB, 46.5% of network-layer bytes.
  • Longest Mirai attack ran 49.7 hours from August 19 to August 21.
  • DNS amplification was 3.43% of network-layer attacks; other UDP floods rose from 14.06% to 31.31%.
  • United States led attacked locations, ahead of China and Indonesia; media remained the top industry.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Aug 19, 2026Longest Mirai attack began and ran 49.7 hours · Cloudflare Blog
  2. Aug 21, 2026That sustained Mirai attack ended · Cloudflare Blog
  3. Oct 29, 2026Cloudflare published its Q3 2026 DDoS threat report · GBHackers

What each outlet adds

beyond the shared facts
  • Cloudflare BlogNames four IoT botnets and Mirai’s August byte share
  • Cyber Security NewsFiltered petabytes and UDP’s share rising to 31.31%
  • GBHackersPlaces Indonesia third and notes diversified targeting
Vendors
Cloudflare
Malware
MiraiAisuruKimWolfJackSkidMossadDysphoriaEvooo1Bot
Organizations
Cloudforce OneU.S. Department of Justice
Countries
United StatesChinaIndonesiaCanadaIsrael

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Cloudflare BlogFirst report

    Cloudflare: short DDoS bursts rose 208% in Q3 2026

    Attacks over 1 Tbps fell to 251 from 805 after takedowns of four large IoT botnets.

  2. · 1d ago Cyber Security News

    Cloudflare blocked over 8,200 network DDoS attacks an hour in Q3

    Most attacks lasted under ten minutes and stayed below 1 Gbps, while terabit-scale floods fell nearly 69% from the prior quarter.

  3. · 18h ago GBHackers

    Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026

    Attacks rose 208% year over year, but 98% stayed under 1 Gbps and most ended within ten minutes.