Cloudflare Q3 2026 DDoS Report: Short-burst attacks surge 208% as hyper-volumetric attacks drop 69%

• Short-burst, low-bandwidth DDoS attacks lasting under 10 minutes and 1 Gbps surged by 208%, while hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2.
• Attackers abandoned CLDAP floods, which collapsed by 99.5% quarter-over-quarter, pivoting to DNS amplification (up 215%) and general UDP floods (up 122%).
• The United States reclaimed the most-attacked position from China, while Canada and Israel saw sharp spikes in targeted attacks, jumping 10 and 7 spots respectively.
• Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026, totaling 272.6 PB and 95.1 PB of traffic respectively.

Attack Vectors and Botnets

• IoT botnets remain a durable threat despite the decline in hyper-volumetric attacks, with new variants like Dysphoria and Evooo1Bot emerging.
• Mirai-classified mitigation peaked in August at 57.23 PB, representing 46.5% of all mitigated network-layer bytes in Q3.
• The quarter's longest sustained Mirai attack ran for 49.7 hours between August 19 and August 21.

Geographic and Industry Targets

• Media, Production & Publishing remained the most-attacked industry but its share dropped to roughly a quarter of its Q2 level.
• Internet rose from outside the top 10 to #6, while Consumer Services and Adult Entertainment reached #8 and #9.
• Canada jumped from #16 to #6 due to attacks on Retail, Telecommunications, and Marketing sectors; Israel moved to #10 following sustained activity in mid-September.