Network DDoS rose 38% as short floods replaced the terabit attacks

Cloudflare’s third-quarter 2026 DDoS report puts network-layer denial of service on a steady clock. The company mitigated about 18.2 million layer-3 attacks in the quarter, up from 13.2 million in the second quarter and 10.0 million in the first. That is a 38 percent rise from the prior quarter. In the same period it mitigated 14.4 trillion HTTP DDoS requests. The network-layer pace works out to about 8,226 attacks an hour, roughly 197,400 a day, one every 0.44 seconds.

The Hacker News carried the figures from Cloudflare’s quarterly report. Cloudflare ties the rise to the DDoS-for-hire market: booter and stresser services that sell a flood the way a panel sells a virtual machine.

Shorter attacks, higher count

Attacks above 1 terabit per second fell 69 percent, from 805 to 251. Cloudflare links that drop to law-enforcement action in March against operations known as AISURU, KimWolf, JackSkid, and Mossad. Newer variants the report calls Dysphoria and Evooo1Bot are still appearing. The terabit events got rarer. The ordinary events did not.

Short bursts under ten minutes and under 1 gigabit per second rose 208 percent. A flood that size will not lead a year-in-review post. It will still exhaust an origin, a narrow uplink, or a DNS path sized for a normal afternoon. Capacity planning that only models the record attack will miss the one a booter panel actually sells.

The protocol mix moved with that market. CLDAP reflection floods declined. DNS amplification’s share of layer-3 attacks rose 215 percent, to 3.43 percent. Amplification is an old method. A larger share means the packets to watch have shifted, and a playbook aimed only at the last reflection wave is aimed at the wrong traffic.

Who is absorbing the floods

Cloudflare’s industry list for the quarter runs through media and publishing, IT services, gambling, software, and telecommunications. Those businesses lose money when a name stops resolving or a front page times out. They are also the customers a resentment-priced booter service is built to reach.

The most-attacked countries on Cloudflare’s list are the United States, China, Indonesia, the United Kingdom, and Türkiye. Canada and Israel entered the top ten. Location here mostly marks where targets and network edges sit. A company elsewhere still inherits the flood if its origin or its authoritative DNS is in one of these countries.

What to size for

Expect the short burst, and keep a plan for the terabit event beside it. Confirm that automatic mitigation is on for both network-layer and HTTP floods, and that the threshold will catch a sub-gigabit spike against a small property. A policy tuned for a hundred-gigabit incident can watch a ten-minute booter attack finish.

Keep an upstream scrubbing path, and a contract you can invoke when your own edge is not the one under attack. Give authoritative DNS the same treatment as the website. DNS amplification is a growing slice of what Cloudflare saw. Nameservers that can be used as reflectors need that behavior closed. Nameservers that are the target need rate limits and a provider that can absorb a burst while legitimate lookups still resolve.

Treat booter services as a commodity threat, in the same class as commodity phishing. The industries in this quarter’s ranking — media, IT services, gambling, software, and telecom — should assume a launch requires a grievance and a price list. Tabletop the first fifteen minutes: who is paged, which provider you call, what customers are told, and which origin you shed if the scrubbing center is the only thing still answering.

Fewer hyper-volumetric attacks is good news about a handful of botnet brands. The quarterly count still rose, and on Cloudflare’s network the gap between attacks is under half a second. The flood that matters to a single publisher or carrier will look small until the site is down.

This briefing relies on public reporting by The Hacker News and on Cloudflare’s third-quarter 2026 DDoS report. It does not include attack procedures.