Cloudflare reports surge in smaller, shorter DDoS attacks

Cloudflare has published its DDoS Threat Report for the third quarter of 2026, showing a rise in smaller, shorter attacks.

During the quarter, it mitigated 18.2 million network-layer distributed denial of service attacks, equal to 8,226 an hour or about one every 0.44 seconds. It also recorded 14.4 trillion HTTP DDoS requests.

The figures point to a shift in the attack profile. Some 96% of network-layer incidents ended in under 10 minutes, while 98% remained below 1 Gbps. Cloudflare linked this pattern to DDoS-for-hire services that rely on volume and repetition rather than very large single attacks.

At the other end of the scale, attacks above 1 Tbps fell sharply. Cloudflare counted 251 such incidents in the quarter, down from 805 in the previous quarter, a decline of 69%.

It linked that drop to earlier law enforcement action against four large internet of things botnets: Aisuru, KimWolf, JackSkid and Mossad. Even so, replacement strains are already appearing, including Dysphoria and Evooo1Bot, underlining the persistence of IoT-based attack infrastructure.

Mirai-classified activity remained significant. Mitigation of Mirai-related traffic peaked in August at 57.23 PB, accounting for 46.5% of all mitigated network-layer bytes in the quarter, and included a sustained attack lasting 49.7 hours between 19 and 21 August.

Attack methods

The report also recorded an abrupt change in the techniques used by attackers. CLDAP floods, which had risen strongly in the first half of the year, fell 99.5% quarter on quarter to 0.05% of attacks.

Attackers instead shifted towards DNS amplification and broader UDP flooding. DNS amplification rose 215% to 3.43% of all network-layer attacks, while other UDP floods increased from 14.06% to 31.31%.

These changes suggest attackers are moving quickly between available reflection and amplification methods when one route becomes less effective or more exposed. The pattern also indicates that the threat remains highly adaptable even as certain botnets or vectors are disrupted.

Target shifts

Sector targeting also widened during the quarter. Media, Production & Publishing remained the most-attacked industry, but its share fell to roughly a quarter of its level in the previous quarter.

Other sectors moved up the rankings. Internet rose from outside the top 10 to sixth place, while Consumer Services climbed to eighth and Adult Entertainment reached ninth.

Cloudflare said the shorter, mid-range attacks were aimed mainly at the Computer Software, Gambling & Casinos, and Information Technology sectors. That pattern reflects the appeal of time-sensitive disruption against businesses that depend on continuous online availability.

Geographically, the United States returned to the top position as the most-attacked location, ahead of China in second place. Indonesia moved into third, accounting for 2.93% of total attacks.

Canada recorded one of the biggest shifts, rising 10 places from 16th to sixth. Cloudflare attributed the increase to attacks against Retail, Telecommunications, Service Providers & Carriers, and Marketing & Advertising organisations.

Israel also moved higher in the rankings, climbing seven places to 10th after sustained DDoS activity in mid-September. Cloudflare placed the rise against a backdrop of heightened cyber conflict and domestic political tension.

Automated pressure

The report suggests organisations are contending less with isolated giant attacks and more with a continuous stream of automated disruption attempts. Smaller incidents can still take services offline, especially when repeated at scale or aimed at systems with limited bandwidth and response time.

For companies in Australia and New Zealand, the findings add to concerns about defending growing online operations against low-cost attack tools that are widely available. Businesses with public-facing services, digital transactions or customer platforms are likely to face pressure not only from the size of attacks, but from their frequency and speed.

Cloudflare said mitigated traffic for the quarter totalled 272.6 PB at the network layer and 95.1 PB at the HTTP layer. More than 800 networks worldwide have also signed up to its DDoS Botnet Threat Feed for service providers, intended to help identify and remove abusive IP addresses and accounts used to launch attacks.

"As this quarter's distributions make clear, most attacks end long before a human analyst could see the alert, and the largest attacks still regularly exceed 1 Tbps at a cadence measured in hundreds per quarter," Cloudflare said.