DDoS Attacks Surge 38% as Cheap Attack-for-Hire Services Fuel Short, Sharp Bursts

Cloudflare says it automatically blocked 18.2 million network-layer distributed denial-of-service (DDoS) attacks in the third quarter of 2026, along with 14.4 trillion malicious web requests. That works out to roughly 8,226 attacks per hour, or one every 0.44 seconds. The total compares with 13.2 million in Q2 and 10.0 million in Q1. Cloudflare links the rise to DDoS-for-hire "booter" or "stresser" services, which are responsible for hundreds of thousands of attacks.

The nature of the attacks is changing. Cloudflare's Cloudforce One team reported that short, low-bandwidth attacks lasting under 10 minutes and under 1 Gbps jumped 208%. At the same time, the very largest attacks, those above 1 Tbps, fell 69%, from 805 in Q2 to 251 in Q3. This is likely due to law enforcement action in March against the AISURU, KimWolf, JackSkid and Mossad operations. Cloudflare cautioned that the threat is not neutralised, as new variants such as Dysphoria and Evooo1Bot have emerged. DNS amplification attacks rose 215% to make up 3.43% of network-layer attacks, while CLDAP floods declined.

The most targeted industries were media, production and publishing; information technology and services; gambling and casinos; computer software; and telecommunications. The most attacked countries were the U.S., China, Indonesia, the U.K. and Türkiye, with Canada and Israel entering the top 10.