{"id":160,"date":"2026-10-30T11:19:17","date_gmt":"2026-10-30T10:19:17","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/small-ddos-attacks-on-the-rise-as-large-attacks-decline\/"},"modified":"2026-11-02T16:09:57","modified_gmt":"2026-11-02T15:09:57","slug":"small-ddos-attacks-on-the-rise-as-large-attacks-decline","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/small-ddos-attacks-on-the-rise-as-large-attacks-decline\/","title":{"rendered":"Small DDoS attacks on the rise as large attacks decline"},"content":{"rendered":"

The number of short DDoS attacks below 1 Gbps rose by 208 per cent in the third quarter of 2026. Over the same period, attacks above 1 Tbps fell by almost 69 per cent. These are the findings of Cloudflare’s quarterly report, which also notes a shift in the protocols used and the targets attacked.<\/strong><\/p>\n

Cloudflare bases the figures in its DDoS threat report for the third quarter of 2026<\/a> on data from its own network. According to the company, that network autonomously mitigated 18.2 million network-layer DDoS attacks during the period, in addition to 14.4 trillion HTTP DDoS requests. That works out at an average of 8,226 network-layer attacks per hour, or around 197,400 per day. On average, an attack took place every 0.44 seconds.<\/p>\n

According to Cloudflare, the total volume of mitigated traffic amounted to 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer.<\/p>\n

More small attacks, fewer large ones<\/h3>\n

The report shows a shift in the size of attacks. Attacks lasting less than ten minutes and smaller than 1 Gbps increased by 208 per cent. Hypervolumetric attacks exceeding 1 Tbps fell by almost 69 per cent compared with the second quarter.<\/p>\n

Cloudflare suggests a possible link between this decline and action taken by law enforcement agencies against four large IoT botnets earlier this year. At the same time, the company reports that new variants continue to emerge. As a result, Cloudflare says, IoT botnets remain a persistent threat to network infrastructure.<\/p>\n

Shift in attack protocols<\/h3>\n

Cloudflare also observes a change in reflection and amplification attacks. The number of CLDAP floods fell by 99.5 per cent compared with the previous quarter. According to the report, attackers switched to other connectionless protocols. The number of DNS amplification attacks rose by 215 per cent, while generic UDP floods increased by 122 per cent.<\/p>\n

United States once again the most attacked country<\/h3>\n

The targets of attacks were more geographically dispersed in the third quarter. The United States took back the position of most attacked country from China. Canada climbed ten places in the ranking of most attacked countries, and Israel seven. Cloudflare links these rises to geopolitical tensions, trade disputes and controversial domestic events in both countries.<\/p>\n

The sectors targeted by attackers also changed. Whereas media organisations were frequently targeted in previous quarters, the report says the focus shifted to a broader range of sectors. These include consumer services, internet infrastructure and the adult entertainment market.<\/p>\n

Small attacks in practice<\/h3>\n

The rise in short attacks with limited bandwidth has implications for the way you monitor traffic. Such attacks can stay below the thresholds of detection systems that are tuned for large volumes. Because an attack is often over within ten minutes, there is little time left for manual intervention.<\/p>\n

The shift from CLDAP to DNS amplification and UDP floods also makes it worthwhile to check how open resolvers and UDP services are configured in client environments. Poorly secured DNS servers can become targets in amplification attacks or can themselves be abused to amplify traffic.<\/p>\n

The full report can be read via the DDoS threat report for the third quarter of 2026<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Cloudflare mitigated 18.2 million network-layer DDoS attacks in the third quarter. Small, short-lived attacks rose by 208 per cent, while attacks above 1 Tbps declined.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169494,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/aantal-kleine-ddos-aanvallen-stijgt-grote-aanvallen-nemen-af\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/zahl-kleiner-ddos-angriffe-steigt-grosse-angriffe-gehen-zurueck\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/10\/hero-1793355543764.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/10\/hero-1793355543764-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Cloudflare saw small DDoS attacks rise by 208 per cent in Q3 2026, while hypervolumetric attacks fell by almost 69 per cent.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-160","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=160"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/160\/revisions"}],"predecessor-version":[{"id":161,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/160\/revisions\/161"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=160"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}