Cloudflare’s quarterly figures land at roughly 8,226 network-layer attacks every hour, which works out to one roughly every 0.44 seconds. The company says it absorbed 18.2 million of them between July and September, plus 14.4 trillion HTTP requests aimed at web applications.
The trajectory is steady rather than spiky. Q1 saw 10.0 million L3 attacks and Q2 brought 13.2 million, putting Q3 38% above the previous quarter. Rented booter and stresser services carry much of the load.
What changed inside that volume is more useful to defenders. Barrages lasting under ten minutes and peaking below 1 Gbps jumped 208%. Those are the attacks that fit inside a rate threshold and finish before an alert finishes paging.
At the other end, hyper-volumetric floods above 1 Tbps fell 69%, from 805 to 251. Enforcement pressure on botnet operators earlier in the year appears to be the cause, though Cloudflare notes fresh variants such as Dysphoria and Evooo1Bot are already filling the gap.
The mix of vectors shifted too. DNS amplification climbed 215% and now accounts for 3.43% of network-layer activity, while CLDAP reflection declined.
Media and publishing drew the most traffic, followed by IT and professional services, gambling operators, software firms and telecommunications carriers. The most-attacked countries were the U.S., China, Indonesia, the UK and Turkiye, with Canada and Israel entering the top ten on retail, telecom and marketing campaigns.
The defensive read is that peak-size planning is misleading. Teams sized for the terabit era should instead validate how quickly short, low-volume bursts are detected and whether mitigation triggers below a gigabit, because that is where the growth sits.
Cloudflare also published a companion piece recommending that network operators review reflection exposure, since amplification techniques depend on the willingness of third-party infrastructure to answer spoofed queries.
