Cloudflare records more attacks, but fewer at the largest scale

Cloudflare says its network mitigated 18.2 million network-layer distributed denial-of-service attacks during the third quarter of 2026, up 208% from the same quarter a year earlier. It also processed 14.4 trillion HTTP DDoS requests. The company calculates that network-layer volume at roughly 8,226 attacks an hour.

The distribution matters more than the headline count. Cloudflare reports that 96% of the network-layer attacks ended within 10 minutes and 98% remained below 1 Gbps. Events above 1 Tbps moved in the opposite direction: the company counted 251 in Q3, down from 805 in Q2. That is a measure of traffic seen and mitigated on Cloudflare's own network, not a census of every attack on the internet.

Amplification traffic moved away from CLDAP

Cloudflare also observed a sharp change in the protocols used for reflection and amplification. CLDAP fell to 0.05% of network-layer attacks after rising during the first half. DNS amplification increased 215% from Q2 and represented 3.43% of attacks, while other UDP floods grew from 14.06% to 31.31%.

For defenders, the pattern argues against tuning capacity and detection only for rare record-setting floods. High-frequency attacks that finish before manual review can begin still create availability risk, and the protocol mix can change within a quarter. Organizations should validate automated rate controls, upstream mitigation and alert thresholds against short bursts as well as peak bandwidth.

The report is useful telemetry, with scope limits

Cloudflare identifies media, production and publishing as the most-attacked industry in its Q3 data, although that sector's share fell substantially from Q2. It ranks the United States first among attacked locations, followed by China, with Indonesia third. Those rankings reflect Cloudflare customers and classification methods; they should not be read as a neutral global league table.

The report was posted October 29, but the public page does not provide a release time. It announces no separately priced product or geographic rollout. CGH has not audited Cloudflare's telemetry, reproduced its calculations or tested the company's mitigation services.