Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

DDoS Attacks Jump 38% in Q3 2026 as Short, Stealthy Floods Take Over

More than 8,200 network-layer DDoS attacks an hour in Q3 2026. Record-size floods are down, while short, low-bandwidth bursts and DNS amplification surge.

4T4Tify Team4Tify
Oct 31, 2026·4 min read
DDoS Attacks Jump 38% in Q3 2026 as Short, Stealthy Floods Take Over

DDoS Volumes Jump 38% in Q3 2026 as Short, Stealthy Floods Take Over

Network-layer DDoS activity hit a new high in the third quarter of 2026. Telemetry from one of the largest mitigation networks shows roughly 8,226 network-layer (L3) attacks every hour, about 197,400 a day, or one new attack every 0.44 seconds.

What happened

  • 18.2 million network-layer DDoS attacks were mitigated in Q3 2026, up from 13.2 million in Q2 and 10.0 million in Q1. That is a 38% rise quarter over quarter.
  • On top of that came 14.4 trillion malicious HTTP requests at the application layer.
  • Much of the growth is tied to DDoS-for-hire "booter" and "stresser" services, which let almost anyone rent an attack for the price of a subscription.
  • Short-burst, low-bandwidth attacks (under 10 minutes and under 1 Gbps) grew 208%.
  • Hyper-volumetric attacks above 1 Tbps fell 69%, from 805 in Q2 to 251 in Q3. The drop most likely follows the law-enforcement takedowns in March against the AISURU, KimWolf, JackSkid and Mossad botnets. The threat hasn't gone away, though: new variants such as Dysphoria and Evooo1Bot are already appearing.

The attack mix is shifting

  • CLDAP reflection floods have almost disappeared, falling from about 10% of network-layer attacks to a fraction of a percent.
  • DNS amplification jumped 215% and now accounts for 3.43% of network-layer attacks.
  • Generic UDP floods more than doubled their share, to roughly 31%.
  • DNS floods held steady at about 39%, still the single largest category.

The most targeted sectors were media, production and publishing, IT and services, gambling and casinos, computer software and telecommunications. The U.S., China, Indonesia, the U.K. and Türkiye were the most attacked countries. Canada and Israel entered the top ten, with Canada's rise driven by attacks on retail, telecom and marketing companies.

Why it matters

The move toward short, low-bandwidth bursts is the real story. Attacks that last a few minutes and stay under 1 Gbps can finish before a human-triggered or threshold-based defence even engages. They are cheap to launch, easy to repeat, and well suited to disrupting checkout pages, login flows, APIs and game servers during peak hours. Fewer record-breaking floods does not mean less risk. It means more frequent, smaller attacks aimed at the services you actually depend on.

What to do

  1. Put always-on, automatic DDoS mitigation in front of every public service. On-demand protection that has to be switched on is too slow for a three-minute burst.
  2. Hide your origins. Make sure origin servers only accept traffic from your mitigation provider, and that no DNS record, old subdomain or certificate log reveals their real IP addresses.
  3. Harden DNS. Close open resolvers, enable response rate limiting, and check that authoritative DNS has enough capacity and redundancy to absorb amplification and flood traffic.
  4. Lock down UDP. Block or rate-limit UDP services you don't need (CLDAP, SSDP, Memcached, NTP monitoring) at the edge, so your infrastructure can't be abused as a reflector either.
  5. Alert on short spikes. Tune monitoring to catch sub-10-minute anomalies, and rehearse a DDoS runbook with your providers before you need it.

Most of these steps start with knowing exactly what you expose to the internet. Our Attack Surface Management service continuously maps your public hosts, subdomains, DNS records and open services, so a forgotten origin server or an exposed UDP service gets flagged before someone uses it against you.

SHARE