Cloudflare reports a huge increase in the number of DDoS attacks during the third quarter of 2026. Although the attacks occur more often, they are on average smaller than before.
The global threat of DDoS attacks is changing in nature. According to the latest data from Cloudflare, the focus is shifting from a handful of gigantic attacks to an enormous number of smaller, faster incidents.
Every quarter, Cloudflare shares figures on how DDoS attacks are evolving worldwide. The data show that the frequency of attacks has reached an unprecedented level, putting heavy pressure on the global internet infrastructure.
One attack every half second
In the third quarter of 2026, Cloudflare’s network mitigated 18.2 million network-layer DDoS attacks. In addition, 14.4 trillion HTTP DDoS requests were stopped. That works out at an average of 8,226 attacks per hour, which means an attack takes place every 0.44 seconds. By the time you have finished reading this sentence, a handful of new attacks have already been launched.
What stands out is the change in the size of the attacks. The number of attacks that last less than 10 minutes and have a bandwidth of less than 1 Gbps tripled. This contrasts sharply with attacks of more than 1 Tbps, which fell by almost 69 percent. Cloudflare therefore saw no record-breaking DDoS attacks this quarter. In the previous quarter, it was precisely this type of attack that increased.
This drop in the largest attacks could be the result of actions by law enforcement agencies against four major IoT botnets earlier this year. Still, Cloudflare warns that new variants of these botnets keep appearing, which underlines the ongoing threat to networks. The internet company is adjusting its own methods to tighten protection against bots.
Changing tactics and targets
Attackers constantly adapt their methods to evade detection. The usual CLDAP floods almost completely disappeared. Instead, there is a sharp 215 percent rise in DNS amplification and a 122 percent increase in general UDP floods.
The geographic spread of targets is also shifting. The United States is once again the most attacked country, taking over the position held by China. Canada and Israel also saw a sharp rise in the number of targeted attacks due to local political and geopolitical tensions.
The attackers’ focus is shifting from media organisations to industrial targets, such as consumer services, internet infrastructure and the adult entertainment market. The total volume of mitigated traffic this quarter came to 272.6 PB at the network layer and 95.1 PB at the HTTP layer.