251 DDoS attacks topped 1 Tbps in Q3, down from 805 in Q2 — Cloudflare
What happened
Cloudflare recorded 251 network-layer DDoS attacks above 1 terabit per second in the third quarter of 2026, down from 805 in the second quarter, a drop of nearly 69%. Over the same quarter it mitigated 18.2 million network-layer DDoS attacks, about 8,226 per hour, and 96% of them ended in under 10 minutes. Cloudflare tentatively links the fall in the largest attacks to law enforcement action earlier in 2026 against four IoT botnets, but says IoT botnets remain a durable threat.
What we know
- Per Cloudflare's Q3 2026 DDoS Threat Report, attacks above 1 Tbps fell to 251 from 805 in Q2, while Cloudflare mitigated 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests in the quarter.
- Per Cloudflare, 96% of network-layer attacks ended in under 10 minutes and 98% stayed under 1 Gbps. Cloudflare says that is still enough to overwhelm a server or website, and it reads the profile as the signature of DDoS-for-hire booter services.
- Per Cloudflare and SiliconANGLE, CLDAP floods fell to 0.05% of attacks, down 99.5% quarter over quarter. DNS amplification rose 215% to about 3.4% of network-layer attacks, and other UDP floods rose from 14.06% to 31.31%.
- Per Cloudflare, the United States was the most-attacked location, ahead of China and Indonesia (2.93% of attacks). Canada rose from 16th to 6th and Israel moved up seven places to 10th.
- Per Cloudflare, Mirai-classified traffic peaked in August at 57.23 PB, 46.5% of network-layer bytes mitigated in Q3. The longest Mirai attack lasted 49.7 hours, from August 19 to 21.
- Per SiliconANGLE, the Justice Department announced the disruption of the Aisuru, Kimwolf, JackSkid and Mossad botnets in March, and authorities in Canada and Germany also moved against people allegedly behind them.
What we don't know yet
- Whether the law enforcement takedowns caused the decline in 1 Tbps attacks. Cloudflare presents the link as a possible reflection, not an established cause.
- Whether the drop in giant attacks will last. New IoT botnet variants such as Dysphoria and Evooo1Bot are already circulating.
- How Cloudflare's network-wide figures compare with attack volumes seen by other providers. The report covers only traffic on Cloudflare's own network.
- What drove the targeting shifts toward Canada and Israel. The report points to trade disputes and elections but does not establish attackers' motives.
Why it matters
Defenders at software, gambling and IT companies, the main targets of the booter-style attacks, face a high count of short bursts that can finish before a human analyst sees an alert. Network operators relying on a lasting decline in terabit-scale floods have only a one-quarter data point, and Cloudflare itself says IoT botnets keep producing new variants.
Claims
- ConfirmedCloudflare recorded 251 attacks above 1 Tbps in Q3 2026, down from 805 in Q2.
- ConfirmedCloudflare mitigated 18.2 million network-layer DDoS attacks in Q3 2026.
- Confirmed96% of Q3 network-layer attacks ended in under 10 minutes.
- ConfirmedCLDAP floods fell 99.5% quarter over quarter to 0.05% of attacks.
- ConfirmedDNS amplification attacks rose 215% quarter over quarter.
- ConfirmedThe United States was the most-attacked location in Q3 2026, ahead of China.
- ConfirmedThe Justice Department announced the disruption of the Aisuru, Kimwolf, JackSkid and Mossad botnets in March 2026.
- UnconfirmedThe botnet takedowns caused the drop in attacks above 1 Tbps.
Related coverage
Why you can trust this story
86%Source map · 2 outlets / 2 articles
- Cloudflare Blog
- Article 1blog.cloudflare.comofficial
- SiliconANGLE
How this credibility score is calculated
- Source reliability
- Corroboration
- Primary source
- Claims checked against the source
- No contradiction
- Settled
- Claim attribution
- AI disclosure
Checked claims were verified against the cited source text. Weights are fixed and explainable.
Human accountability
- 2 independent origins / 2 sources
- Drafted by an automated system; a human editor approves every story before it is published.
Verification ledger · 8
- Claim: Cloudflare recorded 251 attacks above 1 Tbps in Q3 2026, down from 805 in Q2.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: Cloudflare mitigated 18.2 million network-layer DDoS attacks in Q3 2026.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: 96% of Q3 network-layer attacks ended in under 10 minutes.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: CLDAP floods fell 99.5% quarter over quarter to 0.05% of attacks.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: DNS amplification attacks rose 215% quarter over quarter.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: The United States was the most-attacked location in Q3 2026, ahead of China.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: The Justice Department announced the disruption of the Aisuru, Kimwolf, JackSkid and Mossad botnets in March 2026.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: The botnet takedowns caused the drop in attacks above 1 Tbps.Status: UnconfirmedVerification trailUnverifiedChecked by verification engine
No automated check against the source text is available.
Update log · 0
AI accelerates. High-risk topics wait for a human editor.