Cloudflare’s third-quarter telemetry shows a sharp decline in the largest network attacks alongside a much larger total attack count. Attacks above one terabit per second fell from 805 in the second quarter to 251 in the third, a decline of about 69%. Botnet takedowns coincided with the reduction, but the report does not establish that they caused it.
At the same time, Cloudflare recorded 18.2 million network-layer attacks, up 208% from a year earlier, and 14.4 trillion HTTP DDoS requests. Those are different units: the HTTP figure counts requests, not attacks. Within the network-layer total, 96% ended in under ten minutes and 98% stayed below one gigabit per second; the report does not provide the joint share that was both brief and small.
“Other UDP floods” rose from 14.06% to 31.31% of network-layer attacks, while DNS amplification represented 3.43%. Cloudflare describes a 215% surge in DNS amplification without giving the base value or specifying whether the growth applies to counts or share. The observations describe Cloudflare’s network, not an Internet-wide census.
Source: Cloudflare’s Q3 2026 DDoS report