Hackers Launch 8,200 DDoS Attacks Every Hour, Cloudflare's Latest Report Reveals

Hackers Launch 8,200 DDoS Attacks Every Hour, Cloudflare’s Latest Report Reveals 🚀

Cloudflare blocked an average of more than 8,200 network-layer DDoS attacks every hour during the third quarter of 2026. This highlights how attackers are increasingly using frequent, short bursts to disrupt online services instead of relying solely on record-breaking traffic floods.

The company’s latest DDoS Threat Report, produced by its Cloudforce One threat intelligence team, covers the period from July through September. Cloudflare successfully stopped 18.2 million network-layer attacks and 14.4 trillion malicious HTTP requests during this timeframe. Notably, network-layer attack numbers surged by 208% compared to the same quarter in 2025. Approximately 96% of these attacks concluded within ten minutes, while 98% remained below one gigabit per second.

Cloudflare attributes this pattern to DDoS-for-hire services, often referred to as booters, which allow customers to pay for launching attacks. Common targets of these frequent bursts include computer software, gambling and casino businesses, and information technology companies.

The Challenge for Defenders

The timing of these attacks presents a significant challenge for defenders. With most attacks finishing within minutes, teams cannot rely on reviewing alerts and manually adjusting filters before users lose access. Therefore, detection and traffic filtering must occur automatically.

In contrast to the frequent short bursts, attacks exceeding one terabit per second decreased from 805 in the second quarter to 251 in the third, marking a decline of nearly 69%. Cloudflare suggests that this drop may be linked to earlier law enforcement actions, although the report does not establish a direct cause. On March 19, the U.S. Justice Department announced a coordinated operation against infrastructure supporting Aisuru, KimWolf, JackSkid, and Mossad. Authorities reported that these botnets had infected over three million devices worldwide, including routers, cameras, and digital video recorders.

Changing Attack Methods

Attack methods have also shifted significantly. CLDAP reflection attacks plummeted by 99.5% from the previous quarter, now representing just 0.05% of network-layer attacks. This method exploits exposed directory services by sending requests with a forged victim address, causing servers to direct larger replies at that victim. Conversely, DNS amplification attacks surged by 215%, accounting for 3.43% of network-layer attacks.

For more details, Read full article.