DDoS attacks surge 208% as Indonesia ranks third globally

Cloudflare recorded a 208% rise in DDoS attacks in Q3 2026, with 96% lasting under 10 minutes, while Indonesia ranked third globally.

Distributed denial-of-service (DDoS) attacks became more frequent in the third quarter of 2026, even as the number of extremely large attacks declined. According to Cloudflare's latest DDoS Threat Report, the company mitigated 18.2 million network-layer attacks between July and September, an increase of 208% compared with the same period last year.

The United States was the most-attacked location, followed by China and Indonesia. Indonesia rose one place to third, accounting for 2.93% of attacks recorded across Cloudflare's network, while Vietnam dropped two places to ninth. China had held the top position during the first half of 2026.

The report, produced by Cloudflare's threat intelligence team, Cloudforce One, found that 96% of network-layer attacks lasted less than 10 minutes, while 98% remained below 1 gigabit per second (Gbps). Cloudflare also recorded an average of 8,226 network-layer attacks per hour.

The company also mitigated 14.4 trillion HTTP DDoS requests, with total mitigated traffic reaching 272.6 petabytes (PB) at the network layer and 95.1 PB at the HTTP layer.

DDoS attacks shift in scale and methods

While the overall number of attacks increased, attacks exceeding 1 terabit per second (Tbps) fell by nearly 69% compared with the previous quarter. Cloudflare recorded 251 such attacks in Q3, down from 805 in Q2.

The decline coincided with law enforcement operations targeting four major Internet of Things (IoT) botnets: Aisuru, KimWolf, JackSkid, and Mossad. In March 2026, authorities in the United States, Canada, and Germany coordinated actions against infrastructure used by these botnets.

According to the U.S. Department of Justice (DOJ), the networks had compromised more than three million devices worldwide and were involved in hundreds of thousands of DDoS attacks.

Some attacks reached approximately 30 Tbps. The DOJ also identified attacks targeting IP addresses belonging to the U.S. Department of Defense Information Network. Court documents identified digital video recorders, webcams, and Wi-Fi routers among the compromised devices. The operators allegedly sold access to infected devices to other cybercriminals for use in DDoS attacks.

Cloudflare also identified emerging IoT botnet variants, including Dysphoria and Evooo1Bot. Mirai-classified attack traffic remained active, with the longest sustained attack lasting 49.7 hours between August 19 and August 21.

Separate research from NETSCOUT recorded more than 9.1 million DDoS attacks across 209 countries and territories during the first half of 2026. Its DDoS Threat Intelligence Report found that attacks lasting one minute or less increased from 1.6% of observed incidents in the second half of 2025 to 3.1% in the first half of 2026.

The findings were based on NETSCOUT's ATLAS threat intelligence platform, which monitors a different network environment from Cloudflare and covers a separate reporting period.

Cloudflare also reported changes in the methods used to carry out DDoS attacks. Connectionless Lightweight Directory Access Protocol (CLDAP) attacks declined by 99.5% quarter over quarter, accounting for just 0.05% of network-layer attacks in Q3.

Meanwhile, DNS amplification attacks increased by 215%, accounting for 3.43% of network-layer incidents. UDP floods also increased, with their share rising from 14.06% in Q2 to 31.31% in Q3.

According to Cloudflare, short-burst attacks primarily targeted computer software, gambling and casinos, and information technology businesses. The company associated the attack patterns with DDoS-for-hire services.

DDoS targets span more industries

The distribution of attacks across industries also changed during the quarter. Media, production, and publishing remained the most-attacked industry, although its share of attacks fell to roughly a quarter of its Q2 level.

Internet services entered the top 10 most-attacked industries at sixth place, while consumer services and adult entertainment ranked eighth and ninth, respectively.