Hackers Launch 8,200 DDoS Attacks Every Hour, Cloudflare’s Latest Report Reveals

Cloudflare blocked an average of more than 8,200 network-layer DDoS attacks every hour during the third quarter of 2026, showing how attackers are using frequent, short bursts to disrupt online services rather than relying only on record-breaking traffic floods.

The company’s latest DDoS Threat Report, produced by its Cloudforce One threat intelligence team, covers July through September. Cloudflare stopped 18.2 million network-layer attacks and 14.4 trillion malicious HTTP requests during the period. These are separate measures, not a combined attack count.

The hourly figure reflects attacks detected across Cloudflare’s network, not a complete worldwide total. Its systems filtered 272.6 petabytes of network-layer traffic and another 95.1 petabytes of HTTP attack traffic.

Cloudflare DDoS attacks

Network-layer attack numbers increased 208% compared with the same quarter in 2025. About 96% ended within ten minutes, while 98% stayed below one gigabit per second. That traffic can still overwhelm a website or server without enough protection.

Cloudflare linked this pattern to DDoS-for-hire services, often called booters, which let customers pay to launch attacks. Computer software, gambling and casino businesses, and information technology companies were common targets of these frequent bursts.

The timing creates a clear problem for defenders. When most attacks finish within minutes, teams cannot depend on reviewing an alert and manually changing filters before users lose access. Detection and traffic filtering need to happen automatically.

Attacks exceeding one terabit per second fell from 805 in the second quarter to 251 in the third, a decline of nearly 69%. Cloudflare said this drop may reflect earlier law enforcement action, although the report does not establish a direct cause.

On March 19, the U.S. Justice Department announced a coordinated operation against infrastructure supporting Aisuru, KimWolf, JackSkid, and Mossad. Authorities said the botnets had infected more than three million devices worldwide, including routers, cameras, and digital video recorders.

Cybersecurity News previously covered the disruption of these IoT botnets and the seizure of infrastructure used to control infected devices. The latest figures suggest progress against large attack networks, but not an end to the threat.

Mirai-related activity remained significant. The longest sustained Mirai attack lasted 49.7 hours between August 19 and August 21. Earlier reporting on the 31.4 Tbps Aisuru attack also shows how much traffic large botnets can generate.

Attack methods changed sharply. CLDAP reflection attacks fell 99.5% from the previous quarter and represented just 0.05% of network-layer attacks. This method abuses exposed directory services by sending requests with a forged victim address, causing servers to direct larger replies at that victim.

DNS amplification increased 215% and accounted for 3.43% of network-layer attacks. As Cloudflare’s DNS amplification guide explains, attackers exploit open DNS resolvers to turn small requests into larger responses sent toward a target.

Other UDP floods increased their share from 14.06% to 31.31%. UDP does not require a connection handshake, allowing attackers to send large volumes of packets that consume bandwidth and server resources.

The United States replaced China as the most-attacked location, with Indonesia third. Canada climbed from sixteenth to sixth, while Israel rose seven places to tenth. These rankings describe targeted locations, not where attackers live.

Media, production, and publishing remained the most-attacked industry, despite a sharp drop in its share. Internet businesses reached sixth place, followed by consumer services in eighth and adult entertainment in ninth, showing a broader spread of targets.

The company also offers a free DDoS Botnet Threat Feed for service providers. More than 800 networks have joined, helping operators identify abusive IP addresses and accounts linked to attacks and support coordinated botnet cleanup efforts.

Cloudflare says its defenses operate across more than 330 cities with 500 Tbps of network capacity. The findings highlight why DDoS protection must handle both repeated short bursts and prolonged floods, while providers work together to remove compromised devices from attack networks.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Hackers Launch 8,200 DDoS Attacks Every Hour, Cloudflare’s Latest Report Reveals appeared first on Cyber Security News.