DDoS attacks have regularly broken records, but Cloudflare is now seeing a trend toward smaller bursts of traffic that occur much more frequently. The number of attacks exceeding 1 Tbps dropped by 69 percent this quarter, possibly due to the takedown of four major IoT botnets this year. Attackers also increasingly opted for DNS amplification and UDP floods instead of CLDAP.
Connectionless Lightweight Directory Access Protocol (CLDAP) is in decline, according to Cloudflare’s new DDoS threat report 2026 Q3. There was a 99.5 (!) percent drop. Nevertheless, there was still enough traffic for Cloudflare to block. Between July and September, the DNS provider mitigated 18.2 million DDoS attacks at the network level and 14.4 trillion malicious HTTP requests. To put that in perspective, that’s more than 8,200 attacks per hour.
The vast majority of these attacks are small and short-lived. A whopping 96 percent were over within ten minutes, and 98 percent remained below 1 Gbps. That’s still more than enough to take down a website if there are no mitigation measures in place, by the way. According to Cloudflare, this is the typical pattern of DDoS-for-hire services, known as “booters.”
Giants (for now) out of the picture
At the other end of the spectrum, the number of “hypervolumetric” attacks dropped from 805 in Q2 to 251. These are attacks exceeding 1 Tbps. This decline coincides with the international operation in March targeting the botnets Aisuru, KimWolf, JackSkid , and Mossad. Aisuru had previously been responsible for a record attack of 31.4 Tbps. According to German police, Aisuru and KimWolf each consisted of millions of infected devices, such as routers, webcams, and Android TV boxes.
The threat persists, however. New variants such as Dysphoria and Evooo1Bot have already emerged to take over from the earlier threats. Other threats are also already on Cloudflare’s radar. For example, Mirai traffic peaked at 57.23 PB in August, and the longest attack by this botnet lasted 49.7 hours.
From CLDAP to DNS
Furthermore, the shift in attack vectors is striking. The CLDAP attacks mentioned earlier rose by 580 percent in the first half of the year but now account for only 0.05 percent of all attacks. Attackers switched to DNS amplification (up 215 percent) and other UDP floods, whose share rose from 14 to 31 percent.
The United States has taken the undesirable top spot as the most-attacked country, taking that title from China. Canada climbed from 16th to 6th place, and Israel rose seven spots to 10th. The media sector remains the most-attacked sector, although its share has shrunk to one-quarter of the Q2 level.
Cloudflare says it has 500 Tbps of network capacity in more than 330 cities. More than 800 networks now use the company’s free DDoS Botnet Threat Feed.