DDoS attack trends: more swarms, fewer giants

Cloudflare reports a major shift in DDoS activity for July through September 2026, with many more short, low-bandwidth attacks and far fewer hyper-volumetric floods. The Cloudflare Blog frames the quarter as "More swarms, fewer giants," and gives detailed counts and trends that matter for websites and small infrastructure.

What Cloudflare measured

According to the Cloudflare Blog, its network autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in the quarter. That equates to roughly 8,226 network-layer attacks per hour, or about one attack every 0.44 seconds. The mitigated traffic totals were 272.6 PB at the network layer and 95.1 PB at the HTTP layer. Cloudflare also notes its network protects more than 20% of the web, which is the vantage point for these numbers.

DDoS attack trends: short bursts and UDP shifts

Cloudflare attributes the overall pattern to a surge in short, mid-range, high-count attacks commonly associated with DDoS-for-hire services. Network-layer attacks rose 208% versus the same quarter in 2025, and most of these attacks ended quickly: 96% lasted under 10 minutes, and 98% stayed under 1 Gbps, levels that can still overwhelm a single server or a small website.

At the other end, hyper-volumetric attacks above 1 Tbps dropped sharply, falling to 251 attacks in the quarter from 805 the prior quarter, a decline Cloudflare ties to law enforcement disruption of four major IoT botnets earlier in the year. Still, IoT-based botnets remain a high-volume threat, and Cloudflare flagged ongoing variants such as Dysphoria and Evooo1Bot. Mirai-class mitigation peaked in August at 57.23 PB, making up 46.5% of all mitigated network-layer bytes for the quarter, and the longest sustained Mirai-style event ran 49.7 hours.

Vector choices also shifted. CLDAP floods nearly vanished, collapsing to 0.05% of attacks after a big surge earlier in the year, while DNS amplification rose 215% to 3.43% of network-layer attacks. Other UDP floods climbed from 14.06% to 31.31% of network-layer attacks, reflecting attackers pivoting to connectionless protocols that are easy to weaponize for reflection and amplification.

Why this matters for small businesses, nonprofits, and public teams

The changing shape of attacks changes how they affect you. Short, low-bandwidth attacks are cheaper for attackers to run, easy to buy from booter services, and suitable for taking down a single server or application endpoint. If your site or API runs on a single origin, uses a small hosting plan, or exposes UDP services without filtering, you are more exposed to this higher-volume of short bursts.

Geographically and by industry, Cloudflare also reported diversification: the United States was the most-attacked location, with China and Indonesia following, and industries beyond media saw higher shares, including consumer services and internet infrastructure. If your organization is in an affected sector or region, expect more frequent, short incidents rather than occasional massive floods.

Practical steps you can take

• Use a CDN or DDoS-capable front end: put a content delivery or edge service in front of your origin so attack traffic can be absorbed before it reaches your servers. Cloudflare notes it offers free, unmetered DDoS protection on every service across its network.
• Apply rate limits and request filtering: configure rules to limit abusive request patterns and short, repeated bursts against login, form, or API endpoints.
• Harden UDP exposure: review and restrict unnecessary open UDP services and ports on public-facing hosts and firewalls to reduce reflection vectors.
• Segment and update IoT devices: isolate internet-connected devices from production networks and keep firmware current where possible to reduce botnet recruitment risk.
• Coordinate with your provider: ask your host, ISP, or CDN about automated mitigation and whether they participate in threat feeds or shared blocklists.
• Consider threat feeds and collaboration: Cloudflare offers a free DDoS Botnet Threat Feed for service providers to identify abusive IPs, which can help hosting and network operators take down botnet nodes.

How Cloudflare is helping and what to watch next

The Cloudflare Blog emphasizes automation: its systems detect and mitigate attacks without human intervention because most incidents end faster than an analyst can respond. Cloudflare points to its global presence across 330-plus cities and a capacity it reports at 500 Tbps as part of its ability to absorb current attack volumes. It also offers a continuously updated view of attack trends via Cloudflare Radar and the DDoS Botnet Threat Feed for networks who want to collaborate on takedowns.

What to watch next is whether attackers keep favoring short bursts and UDP-based amplification, and how quickly botnet ecosystems spawn new variants after takedowns. If you run WordPress sites, forms, or small APIs, prioritize edge protections, rate limiting, and reducing exposed UDP services. If you want help assessing DDoS exposure or implementing protections, Get help from a Formidable Masterminds developer.

For the full breakdown of numbers and vectors, see Cloudflare's DDoS Threat Report at the Cloudflare Blog: https://blog.cloudflare.com/ddos-threat-report-2026-q3