Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

A network-layer DDoS attack targets the systems that move traffic between devices and services. It abuses network protocols and connection capacity, aiming to overwhelm links, routers, firewalls, or servers. An HTTP DDoS attack operates higher up, sending huge numbers of ordinary-looking web requests to websites or applications. Both attacks deny access, but they stress different parts of the system.

Cloudflare reported 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests in Q3 2026. A network-layer attack might flood a target with packets, while an HTTP attack repeatedly requests pages or other web content. The first mainly consumes network or connection resources. The second can consume application, database, or server-processing resources.

The distinction matters because defenders need different protections. Network-layer filtering can examine traffic patterns and protocols. HTTP defenses must understand web requests and application behavior. The article records both forms, showing that DDoS pressure exists across multiple technical layers rather than through one single attack method.

Network-layer DDoS activity reached 18.2 million attacks during Q3 2026, according to Cloudflare. That equals about 197,400 attacks per day, or roughly 8,226 per hour. Put another way, a new attack appeared about every 0.44 seconds. The scale shows how constantly internet-facing systems were being tested or attacked.

The increase was clear across the year. Cloudflare recorded 10.0 million network-layer attacks in Q1 and 13.2 million in Q2. Q3 therefore exceeded Q2 by 5.0 million attacks and Q1 by 8.2 million. The article links the growth to DDoS-for-hire booter and stresser services, which were responsible for hundreds of thousands of attacks.

The figures measure attacks Cloudflare autonomously mitigated. They do not mean every attack caused an outage, but they show sustained defensive pressure. At the same time, some extreme attacks declined, proving that attack frequency and individual attack size can move in opposite directions.

Low bandwidth does not automatically mean low impact. A DDoS attack can disrupt a website or network by exhausting connection slots, firewall capacity, application resources, or upstream filtering limits. Short attacks can also arrive faster than defenders can investigate and adjust. Their combined effect may be serious even when no single burst is enormous.

Cloudforce One reported that attacks lasting under 10 minutes and using less than 1 Gbps surged 208%. A target might face one burst, recover briefly, and then receive another. Repeated cycles can consume monitoring and response resources. They can also interrupt legitimate users during each burst, even if total traffic remains below the level of a hyper-volumetric attack.

This pattern helps explain why fewer attacks above 1 Tbps does not mean the problem is solved. Attackers can trade size for frequency. Defenders must therefore handle both spectacular floods and persistent, smaller bursts. The Q3 figures show that the latter became especially common.

DDoS-for-hire services lower the technical barrier to launching an attack. Instead of assembling devices, finding targets, and managing traffic themselves, customers can use a booter or stresser service to request an attack. The service operator supplies the attack infrastructure and handles much of the operation. This makes DDoS available to many more people.

The article links the rise in network-layer attacks to these services. It says booter and stresser operations were responsible for hundreds of thousands of attacks. In general, a customer selects a target and attack duration through the service, while compromised or rented systems generate traffic. That arrangement separates the customer from the underlying equipment and technical work.

The result is greater volume and repetition. Many separate customers can create many separate attacks through the same service infrastructure. Cloudflare recorded 18.2 million network-layer attacks in Q3, up from 13.2 million in Q2. The trend shows why shutting down or disrupting such services can matter beyond one individual incident.

Law-enforcement action can reduce the infrastructure available for very large attacks. If an operation loses servers, controllers, or supporting services, it may produce fewer massive floods. Cloudflare associates the 69% decline in attacks above 1 Tbps with actions against AISURU, KimWolf, JackSkid, and Mossad in March.

The change was substantial. Hyper-volumetric attacks dropped from 805 in Q2 to 251 in Q3. That is a reduction of 554 attacks. The decline suggests those actions disrupted major sources of extreme traffic, at least during the period measured. It does not establish that every reduction came from one specific action.

Cloudflare still warned that the threat is not neutralized. New variants, including Dysphoria and Evooo1Bot, have emerged. Attackers can replace disrupted tools or operations, even if the replacement attacks differ in size. The current picture is therefore mixed: the biggest floods declined, but adaptation keeps DDoS a continuing threat.

DNS amplification is a reflection technique that abuses the difference between a small DNS query and a much larger reply. In a typical attack, the attacker causes publicly reachable DNS servers to send replies toward the intended victim. The victim receives traffic it did not request, while the attacker’s original traffic can be comparatively small.

The amplification comes from the DNS response being larger than the query. Attackers commonly misuse source-address information so replies appear to be meant for the victim. The reachable DNS servers then reflect responses toward that address. This combines reflection, extra traffic, and limited visibility into the attacker’s original location.

Cloudflare reported that DNS amplification rose 215% in Q3. It accounted for 3.43% of all network-layer attacks. The increase matters because publicly reachable services can be abused at scale. Defenders must watch both unusual DNS traffic and sudden inbound floods, while service operators need to prevent their infrastructure from becoming part of the attack path.

“Distributed” means the attack traffic is spread across many sources. Those sources may include devices, servers, or networks in different locations. The target sees a crowd of traffic rather than one obvious attacker. This allows the attack to create more pressure and makes the source harder to identify or remove with one block.

Blocking is difficult because legitimate users also come from many networks. A defender that blocks an entire address range, country, provider, or network may remove both malicious and normal traffic. Attack traffic can also vary in protocol, timing, and volume. Filtering must therefore distinguish harmful patterns without rejecting every request from a shared network.

The article illustrates the scale of this challenge. Cloudflare mitigated 18.2 million network-layer attacks in Q3 and identified targets across many industries and countries. The spread included media, technology, gambling, software, and telecommunications. Distributed attacks require ongoing filtering and adaptation, not just a single blacklist.