Cloudflare says it autonomously mitigated 18.2 million network-layer (L3) distributed denial-of-service attacks during the third quarter of 2026, alongside 14.4 trillion HTTP DDoS requests, according to a report covered by The Hacker News.
The volume works out to roughly 197,400 network-layer attacks per day — about 8,226 per hour, or one every 0.44 seconds. The web infrastructure and security company described the figure as a 38% increase; the source material does not specify the comparison period, so the baseline remains unstated.
What is driving the volume at layer 3
The growth in network-layer attacks is distinct from the better-known HTTP request floods that target web applications. L3 attacks aim to exhaust network capacity itself — saturating bandwidth, connection tables, or upstream links before traffic ever reaches an application.
Several structural factors help explain why this volume keeps climbing. So-called booter and stresser services, which sell attack capacity on demand, have lowered the barrier to entry for would-be attackers, while IoT botnets continue to supply cheap, disposable infrastructure. Reflection and amplification techniques — which weaponise protocols such as DNS, NTP, and Memcached to multiply a small request into a large response — have also become largely commoditised, meaning the cost of generating significant traffic volume keeps falling even as detection improves.
For defenders, the practical consequence is that volumetric pressure increasingly arrives upstream of the application layer, which is why autonomous, always-on mitigation matters more than manual incident response for this class of traffic.
What the data does — and does not — show
The figures come from a single vendor's telemetry. Cloudflare operates a large share of global web traffic, but its view is a sample, not a census: attacks that bypass or never touch its network are not counted, and its customer mix shapes what it sees. Sector-level and APAC-specific breakdowns were not detailed in the reporting, and readers should treat any broader regional inference with caution.
The source article also does not identify which actor groups or sectors drove the Q3 increase, so claims about attribution or vertical targeting cannot be substantiated from this material alone.
Why the timing matters for the year-end peak
From a threat-landscape perspective, the timing is worth noting for organisations in Hong Kong heading into the year-end commercial season. E-commerce platforms typically run intensive promotional campaigns in November and December, fintech and payments services see elevated transaction peaks around the same period, and gaming platforms often experience their highest concurrency during holiday availability. These are exactly the windows in which an outage carries the greatest commercial and reputational cost — and in which attackers know defenders are least willing to take risks with uptime.
That does not imply any local organisation has been targeted or is responding to this report. It is a general observation about attacker incentive timing.
A practical mitigation checklist
Organisations reviewing their posture ahead of peak season might consider:
- Traffic scrubbing upstream. Ensure volumetric attacks are mitigated before they consume on-premises bandwidth, whether via an anycast-based provider or dedicated scrubbing capacity.
- Rate limiting and anomaly baselines. Establish normal traffic profiles now, so unusual spikes during promotions are easier to distinguish from genuine demand.
- Redundant connectivity. Multi-carrier or multi-path designs reduce the impact of a single saturated link.
- Incident runbooks with pre-approved escalation. Define who can trigger mitigation and how quickly, rather than negotiating during an attack.
- Post-incident review. Capture attack vectors, durations, and volumes after each event to refine thresholds.
The full Cloudflare Q3 telemetry, as reported by The Hacker News, remains the authoritative source for these figures.
Cloudflare 表示，在 2026 年第三季自主緩解了 1,820 萬次網絡層（L3）分散式阻斷服務（DDoS）攻擊，另有 14.4 萬億次 HTTP DDoS 請求，相關數據由 The Hacker News 報導。
換算下來，網絡層攻擊約為每天 197,400 次、每小時約 8,226 次，即平均每 0.44 秒一次。這家網絡基礎設施及安全公司稱該數字增長 38%；來源材料並未說明比較基準屬按年、按季或另有對照，因此基準未有交代。
為何網絡層攻擊量持續攀升
網絡層攻擊有別於較為人熟悉的 HTTP 請求洪水，兩者的目標並不相同。L3 攻擊旨在直接耗盡網絡容量本身——在流量抵達應用層之前，先佔滿頻寬、連線表或上游鏈路。
多項結構性因素可解釋這股增長。俗稱 booter 及 stresser 的服務按需出售攻擊能力，降低了入行門檻；物聯網殭屍網絡則持續供應廉價、一次性的基礎設施。反射與放大技術——把 DNS、NTP、Memcached 等協議轉化為把小型請求放大成大型回應的工具——亦已大幅商品化，即使偵測技術不斷改進，產生可觀流量的成本仍在下降。
對防禦者而言，實際影響是體積型壓力越來越多在應用層之上游抵達，因此對這類流量來說，自主、持續運作的緩解機制比人工事故應變更為關鍵。
這份數據說明了什麼、又沒有說明什麼
數據來自單一供應商的遙測。Cloudflare 承載全球相當大比例的網絡流量，但其視角是樣本而非普查：繞過或從未接觸其網絡的攻擊不會被計入，其客戶組成亦會影響所見。報導並未提供行業別或亞太區細分，讀者對任何區域層面的推論應審慎處理。
來源文章亦未交代哪些攻擊者群組或行業推動了第三季的增長，因此不能單憑這份材料支持歸因（attribution）或垂直行業針對的說法。
年末高峰的時機為何值得留意
從威脅形勢角度出發，時機對正步入年末商業旺季的香港機構值得留意。電商平台通常在 11 月及 12 月密集促銷，金融科技及支付服務同期交易量攀升，遊戲平台亦往往在假期期間錄得最高並發度。這些正是停機帶來最大商業與聲譽損失的窗口——也是攻擊者明知防禦者最不願在服務正常運行上冒險的時刻。
這並不代表任何本地機構遭到針對，亦非指它們正在回應這份報告。這裡只是一般性地觀察攻擊者的誘因時機。
實務緩解清單
機構在旺季前檢視自身防護狀態時，可考慮：
- 上游流量過濾。 確保體積型攻擊在消耗本地頻寬之前已獲緩解，不論是採用 anycast 提供商還是專用過濾容量。
- 限流與異常基線。 現在就建立正常流量剖析，令促銷期間的異常尖峰較容易與真正需求分辨。
- 冗餘連線。 多電訊商或多路徑設計可降低單一鏈路被佔滿的影響。
- 預先獲批升級的事故應變手冊。 預先定義誰可觸發緩解以及反應速度，而非在攻擊進行中才商討。
- 事後檢討。 每次事件後記錄攻擊向量、持續時間及流量，以進一步校準閾值。
The Hacker News 所報導的 Cloudflare 第三季完整遙測數據，仍是這些數字的權威來源。