Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.
The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44 seconds.
In comparison, a total of 13.2 million and 10.0 million L3 DDoS attacks were recorded in Q2 and Q1 2026, respectively. The increase has been linked to DDoS-for-hire booter or stresser services that are responsible for hundreds of thousands of attacks.
“Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%,” the Cloudforce One threat intelligence team said in its quarterly DDoS Threat Report shared with The Hacker News.
An interesting trend is the decline of hyper-volumetric attacks exceeding 1 Tbps by 69% from the previous quarter – going from 805 attacks in Q2 to 251 in Q3 – likely as a result of law enforcement actions against AISURU, KimWolf, JackSkid, and Mossad earlier this March.
Still, the threat remains far from completely neutralized, given the emergence of new variants like Dysphoria and Evooo1Bot, Cloudflare warned.
Another notable shift is the decline in Connectionless Lightweight Directory Access Protocol (CLDAP) floods, while DNS amplification jumped 215% to account for 3.43% of all network-layer attacks.
The most targeted industries include media, production, and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers.
The U.S., China, Indonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada’s retail, telecommunications, and marketing sectors.
