Cloudflare Blocked 8,226 DDoS Attacks an Hour in Q3

Somewhere on the internet right now, a website is being flooded with junk traffic, and it'll probably be over before anyone notices. That's the big takeaway from Cloudflare's latest DDoS report, and the numbers are a bit wild.

What happened

Cloudflare published its DDoS Threat Report for Q3 2026 on October 29, covering July to September. Its network blocked 18.2 million network-layer DDoS attacks in those three months, along with 14.4 trillion malicious HTTP requests. Cloudflare works that out to about 8,226 attacks an hour, or one every 0.44 seconds.

That's a big step up from the 13.2 million it counted in Q2, which The Hacker News puts at a 38% jump (it also shared the figures on X). A few other things stood out to me in the report:

• Small and fast is in. Short attacks under 10 minutes and under 1 Gbps surged 208%. Cloudflare says 96% of network-layer attacks ended in under 10 minutes.
• Giant attacks dropped. Attacks over 1 Tbps fell from 805 in Q2 to 251 in Q3. Cloudflare links that to police action earlier this year against four big IoT botnets: Aisuru, KimWolf, JackSkid and Mossad.
• New botnets are already filling the gap. The report names variants called Dysphoria and Evooo1Bot.
• Tactics shifted. CLDAP floods almost vanished, falling 99.5%, while DNS amplification attacks rose 215%.
• The US is the most attacked country again, taking that spot back from China. Canada and Israel both climbed sharply in the rankings.

Why it matters

Cloudflare says those short, low-bandwidth floods are the trademark of cheap DDoS-for-hire "booter" services. You don't need a huge botnet to knock a small site, a game server or a shop offline. One gigabit for five minutes is plenty for most servers, and anyone with a few dollars can rent that.

The speed is the real problem. If an attack is done in under ten minutes, there's no time for a person to spot it and react. Protection has to be automatic and always on, or it's basically useless against this kind of traffic.

What to do

• If you run a website, a game server or an online store, put it behind a DDoS protection service. Cloudflare, Akamai and others offer it, and Cloudflare's free plan includes basic protection.
• Don't expose your server's real IP address if you can avoid it. Once attackers know it, a proxy in front doesn't help much.
• If you run your own DNS server, make sure it isn't an open resolver. Open resolvers are what attackers abuse for DNS amplification.
• For everyday users there's nothing to patch, but if a game or app goes down for a few minutes, this is often why.

If you want a simple way to make your own browsing a bit safer and faster, my guide to setting up Private DNS on Android is a good place to start.