> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Cloudflare Blocked 8,226 DDoS Attacks an Hour in Q3
- URL: https://blog.harshkohli.com/cloudflare-ddos-report-q3-2026/
- Published: 2026-10-31T09:00:24.000Z
- Updated: 2026-10-31T09:00:24.000Z
- Description: Cloudflare's Q3 2026 report: 18.2 million DDoS attacks, short booter floods up 208% and giant attacks down. What it means for site owners.
- Author: Harsh Kohli
- Tags: Tech News, Software

Somewhere on the internet right now, a website is being flooded with junk traffic, and it'll probably be over before anyone notices. That's the big takeaway from Cloudflare's latest DDoS report, and the numbers are a bit wild.

## What happened

Cloudflare published its [DDoS Threat Report for Q3 2026](https://blog.cloudflare.com/ddos-threat-report-2026-q3/?ref=blog.harshkohli.com) on October 29, covering July to September. Its network blocked 18.2 million network-layer DDoS attacks in those three months, along with 14.4 trillion malicious HTTP requests. Cloudflare works that out to about 8,226 attacks an hour, or one every 0.44 seconds.

That's a big step up from the 13.2 million it counted in Q2, which [The Hacker News](https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html?ref=blog.harshkohli.com) puts at a 38% jump (it also [shared the figures on X](https://x.com/TheHackersNews/status/2116394263240118304?ref=blog.harshkohli.com)). A few other things stood out to me in the report:

- **Small and fast is in.** Short attacks under 10 minutes and under 1 Gbps surged 208%. Cloudflare says 96% of network-layer attacks ended in under 10 minutes.
- **Giant attacks dropped.** Attacks over 1 Tbps fell from 805 in Q2 to 251 in Q3\. Cloudflare links that to police action earlier this year against four big IoT botnets: Aisuru, KimWolf, JackSkid and Mossad.
- **New botnets are already filling the gap.** The report names variants called Dysphoria and Evooo1Bot.
- **Tactics shifted.** CLDAP floods almost vanished, falling 99.5%, while DNS amplification attacks rose 215%.
- **The US is the most attacked country again,** taking that spot back from China. Canada and Israel both climbed sharply in the rankings.

## Why it matters

Cloudflare says those short, low-bandwidth floods are the trademark of cheap DDoS-for-hire "booter" services. You don't need a huge botnet to knock a small site, a game server or a shop offline. One gigabit for five minutes is plenty for most servers, and anyone with a few dollars can rent that.

The speed is the real problem. If an attack is done in under ten minutes, there's no time for a person to spot it and react. Protection has to be automatic and always on, or it's basically useless against this kind of traffic.

## What to do

- If you run a website, a game server or an online store, put it behind a DDoS protection service. Cloudflare, Akamai and others offer it, and Cloudflare's free plan includes basic protection.
- Don't expose your server's real IP address if you can avoid it. Once attackers know it, a proxy in front doesn't help much.
- If you run your own DNS server, make sure it isn't an open resolver. Open resolvers are what attackers abuse for DNS amplification.
- For everyday users there's nothing to patch, but if a game or app goes down for a few minutes, this is often why.

If you want a simple way to make your own browsing a bit safer and faster, my guide to [setting up Private DNS on Android](https://blog.harshkohli.com/private-dns-android-block-ads/) is a good place to start.