Cloudflare's terabit DDoS floods fell from 805 to 251 as short attacks took over

Cloudflare stopped 18.2 million DDoS attacks at the network layer during the third quarter of 2026, up 208% from the same quarter last year, but the number of giant attacks above 1 terabit per second fell from 805 in the second quarter to 251, according to its quarterly threat report published October 29. Cloudflare links the drop to law enforcement action earlier in the year that dismantled four of the largest IoT botnets.

The result is a quarter the company sums up as "more swarms, fewer giants": far more attacks, nearly all of them small and brief.

The shape of a typical attack now

According to the report, 96% of attacks ended in under 10 minutes and 98% stayed below 1 gigabit per second. That is small by headline standards but, as Cloudflare notes, still enough to knock an ordinary server or website offline.

Cloudflare says this short, mid-sized, high-volume pattern is the signature of DDoS-for-hire booter services, and that these attacks mostly hit computer software, gambling and casino, and IT companies. Averaged over the quarter, the network saw about 8,226 attacks an hour, or one every 0.44 seconds, along with 14.4 trillion malicious HTTP requests.

The botnet takedowns did not end large-scale IoT attacks. New variants such as Dysphoria and Evooo1Bot have appeared, and traffic Cloudflare classifies as Mirai made up 46.5% of the network-layer traffic volume Cloudflare filtered that quarter, peaking in August. The longest single Mirai attack lasted 49.7 hours, from August 19 to 21.

The amplification trick that disappeared

The sharpest change was in technique. CLDAP reflection, which tricks public directory servers into sending large replies to a forged victim address, surged 580% quarter over quarter in the first half of the year. In Q3 it collapsed by 99.5% and now makes up just 0.05% of attacks.

Attackers moved to other connectionless protocols instead. DNS amplification rose 215% to 3.43% of network-layer attacks, and plain UDP floods more than doubled their share, to 31.31% from 14.06%, according to the report.

A wider spread of targets

Media, production and publishing stayed the most attacked industry, but its share fell to about a quarter of its Q2 level. Internet companies jumped from outside the top 10 to sixth, with consumer services and adult entertainment entering at eighth and ninth.

Geographically, the United States returned to the top spot ahead of China, reversing the first-half order, and Indonesia entered the top three with 2.93% of attacks. Canada rose from 16th to sixth, driven by attacks on retail, telecoms, carriers and advertising firms, while Israel climbed seven places to 10th after sustained activity in mid-September.

Cloudflare does not name the largest single attack of the quarter. It says terabit-scale attacks still arrive by the hundreds each quarter, so the drop to 251 marks a lull rather than an end.