Cloudflare measures the collapse of giant DDoS attacks in favor of swarms of small ones
On October 29, 2026, Cloudflare published its Q3 DDoS report: attacks under 10 minutes and under 1 Gbps surged 208%, while attacks above 1 Tbps fell 69%. For operators, the defense changes nature — it is no longer about surviving one massive siege, but about absorbing thousands of short, cheap bursts automatically.
October 29, 2026. Cloudflare publishes its DDoS Threat Report 2026 Q3, built from the data of its own network. +208% — the year-over-year rise in short, low-bandwidth attacks. −69% — the quarter-over-quarter fall in hyper-volumetric attacks above 1 Tbps. 18.2 million — the network-layer attacks Cloudflare mitigated on its own in the third quarter. The point that matters: DDoS no longer looks like a massive siege, but like a swarm of short, cheap bursts that only always-on, automatic mitigation can absorb.
Swarms instead of giants
The quarter’s most striking shift is the fragmentation of the threat. Short, low-bandwidth attacks — under 10 minutes and under 1 Gbps — surged 208% year over year. These, not the terabit records, are now the signature of DDoS-for-hire services, the “booters” rented for a few euros. Cloudflare saw them target software, gambling and casinos, and information technology first.
In the other direction, hyper-volumetric attacks above 1 Tbps fell from 805 in the second quarter to 251 in the third, a drop of nearly 69%. The report links the decline to law-enforcement operations that, in early 2026, dismantled four of the largest IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad. But the ecosystem is already reassembling, with new variants such as Dysphoria and Evooo1Bot: the IoT botnet remains a durable, high-volume threat.
The quarter in numbers
The scale is best read in volume. In Q3 2026, Cloudflare autonomously mitigated 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests. That works out to roughly 8,226 attacks per hour, or 197,400 per day — one attack every 0.44 seconds. Mitigated traffic totaled 272.6 PB at the network layer and 95.1 PB at the HTTP layer.
Two figures capture the shape of today’s attacks: 96% ended in under 10 minutes, and 98% stayed under 1 Gbps. The second number deserves to be weighed: 1 Gbps is more than enough to saturate an average server or website. Most attacks do not need to be gigantic to succeed — they need to be sudden.
Mirai’s return and the vector shift
The report confirms that Mirai, or at least its descendants, never went away. Mitigation of Mirai-classified attacks peaked in August at 57.23 PB, or 46.5% of all mitigated network-layer bytes in Q3, with four days — August 16, 19, 23, and 25 — each clearing 3 PB. The quarter’s longest Mirai attack ran 49.7 hours, between August 19 and August 21.
The second shift is in reflection vectors. CLDAP attacks — tiny queries that, through forged directory servers, bounce amplified responses back at the victim — spiked +580% in the first half before collapsing 99.5% in Q3, to just 0.05% of attacks. Attackers pivoted toward DNS amplification, up 215% (accounting for 3.43% of network-layer attacks), and toward UDP floods, which climbed from 14.06% to 31.31% of network-layer attacks. UDP, a connectionless protocol, remains the vehicle of choice for raw volume.
A wider target, a shifting map
The typical victim is changing too. Media, production & publishing stayed the most-attacked industry in Q3, but its share shrank to about a quarter of its Q2 level, with pressure spreading across a broader spectrum. The Internet sector rose from outside the top ten to #6, while consumer services and adult entertainment entered the ranking at #8 and #9.
Geographically, the United States reclaimed the top spot among the most-attacked countries, ahead of China. Two countries climbed sharply: Canada, from #16 to #6, driven by attacks on retail, telecoms, and marketing; and Israel, up 7 spots to #10, against a backdrop of geopolitical tensions, trade disputes, and an election season.
Verdict
If your DDoS protection only kicks in above a high threshold or requires a human to act, you are exposed to the new swarm: an attack under 1 Gbps lasting under 10 minutes will trip neither your threshold nor your team, yet it will still saturate your server. The fix is always-on, automatic mitigation, sitting upstream, able to absorb 8,000 attacks per hour without anyone lifting a finger. If you depend on an anycast network or a mitigation provider, confirm protection is on by default rather than on demand — that is precisely what this report separates. And if you still believe a DDoS shows up as an obvious spike on a traffic graph, reread the numbers: today’s enemy is no longer the giant that knocks you down, but the swarm that buries you.