Cloudflare Reports 208% Surge in Network-Layer DDoS Attacks as Terabit Floods Decline

Cloudflare mitigated 18.2 million network-layer DDoS attacks and blocked 14.4 trillion malicious HTTP requests in the third quarter of 2026. Network-layer attack counts increased 208% year over year, averaging more than 8,200 attacks per hour across its network. Approximately 96% lasted less than ten minutes, and 98% stayed below one gigabit per second. Meanwhile, attacks exceeding one terabit per second fell from 805 in the previous quarter to 251, a decline of nearly 69%. Cloudflare suggested earlier law enforcement disruptions of four major IoT botnets might have contributed, but did not establish causation; emerging variants and sustained Mirai activity remained threats.

Attack techniques shifted away from CLDAP reflection toward DNS amplification and other UDP floods. The United States replaced China as the most-targeted location, while Canada and Israel rose sharply in the rankings. Media, production, and publishing remained the most-attacked industry, although targeting spread more broadly across sectors. The prevalence of short, lower-bandwidth bursts underscores the need for automated detection and mitigation, alongside capacity to withstand sustained, high-volume floods.