Cyberattacks that knock sites offline hit 18.2 million in three months

Attacks meant to knock websites offline are getting more common. Cloudflare, a company that runs web infrastructure and security, says it automatically stopped 18.2 million of one common type in the third quarter of 2026. That is about 8,226 an hour, or one every 0.44 seconds. The company shared the figures in its quarterly threat report on Thursday.

What changed

The attacks are called DDoS attacks. In plain terms, attackers flood a website or network with so much junk traffic that real visitors cannot get through. The 18.2 million count is for attacks on the network itself. Cloudflare also stopped 14.4 trillion junk requests aimed at websites. The network figure is up from 13.2 million in the second quarter and 10.0 million in the first.

Small and short attacks

Much of the growth came from quick, light attacks. Attacks lasting under 10 minutes and staying under 1 Gbps (a measure of traffic speed) jumped 208%. Cloudflare links the rise to booter or stresser services. These are rent-an-attack sites that let someone pay to hit a target, and they are behind hundreds of thousands of attacks.

Fewer giant attacks

The very largest attacks went the other way. Those above 1 Tbps, which is 1,000 times the 1 Gbps mark, fell 69%. They dropped from 805 in the second quarter to 251 in the third. Cloudflare says this is likely due to law enforcement action in March against networks called AISURU, KimWolf, JackSkid and Mossad.

The threat is not gone. Cloudflare warns that new variants, including Dysphoria and Evooo1Bot, have appeared. It also saw DNS amplification attacks jump 215%, reaching 3.43% of all network attacks. DNS works like the internet's address book, and this method abuses it to magnify traffic. Another older method, called CLDAP floods, declined.

Who is hit

The most targeted industries were media, production and publishing, then information technology and services, gambling and casinos, computer software, and telecom providers. The most attacked countries were the U.S., China, Indonesia, the U.K. and Türkiye. Canada and Israel entered the top 10. Canada's rise was fueled by attacks on its retail, telecom and marketing sectors.

What to do

If your business depends on a website or online store, even a short attack can cost you sales. Ask your web host or hosting provider what attack protection is included, and whether it covers short bursts. The report does not say how many sites were knocked offline, only how many attacks were stopped.