# DDoS got smaller, faster and far more frequent _Cloudflare mitigated 18.2M network attacks in Q3 as short-burst swarms surged 208% and 1 Tbps attacks fell 69%._ **Published:** 2026-10-30 **Source:** https://www.startuphub.ai/ai-news/artificial-intelligence/2026/ddos-got-smaller-faster-and-far-more-frequent --- [Cloudflare](https://blog.cloudflare.com/ddos-threat-report-2026-q3/) said it autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP requests in Q3, about 8,226 network-layer attacks per hour, with short-burst attacks under 10 minutes and under 1 Gbps up 208% year over year, per its Cloudforce One report. The attacks are remote and require no local access, using spoofed UDP and HTTP floods to exhaust network and compute on servers and websites, and Cloudflare said it absorbed 272.6 PB at the network layer and 95.1 PB at the HTTP layer. The giants went missing. Hyper-volumetric network-layer attacks exceeding 1 Tbps fell to 251 in Q3 from 805 in Q2, a drop of nearly 69% that [Cloudflare](https://www.startuphub.ai/startups/cloudflare) linked to law enforcement action early in 2026 against four IoT botnets named Aisuru, KimWolf, JackSkid and Mossad, per the report. SiliconANGLE reported that the Q2 total itself followed a sixfold rise from Q1, which puts the Q3 pullback in context as a reversal rather than a new normal. Mirai-class mitigations still dominated bytes, peaking at 57.23 PB in August, or 46.5% of all mitigated network-layer bytes in Q3, per Cloudflare, and the longest sustained Mirai attack ran 49.7 hours between Aug. 19 and 21. Vectors flipped hard in the quarter, Cloudflare said. CLDAP reflection floods, which surged 580% in the first half, collapsed to 0.05% of attacks in Q3, down 99.5% quarter over quarter, while DNS amplification rose 215% to 3.43% of network-layer attacks and general UDP floods climbed from 14.06% to 31.31%. Both rely on connectionless protocols where small spoofed queries trigger large replies from open resolvers or controllers, a cheap way to aim traffic at a victim without maintaining a session. Targets broadened, per the report. The United States reclaimed the most-attacked position from China, and Cloudflare said Canada jumped 10 spots and Israel jumped 7 spots amid geopolitical tensions and trade and domestic disputes. Media, Production and Publishing remained the most-attacked industry but its share fell to roughly a quarter of its Q2 level, while Internet rose from outside the top 10 to No. 6 and Consumer Services and Adult Entertainment entered the top 10 at No. 8 and No. 9, with booter-style swarms focused on software, gambling and IT. What the report does not show is the rest of the internet, since counts reflect only traffic seen and mitigated on Cloudflare’s network. A shared view from other large mitigators or carriers would change the read on whether swarms are growing globally or just concentrating where Cloudflare has visibility. The open question is whether cheap, short swarms permanently replace the giant IoT-driven floods or simply fill the gap until new variants like Dysphoria and Evooo1Bot scale again. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory. © StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.