Cloudflare Says Network‑Layer DDoS Assaults Surge 38% in Third Quarter

Cloudflare, the global web‑infrastructure provider, disclosed on Thursday that it blocked 18.2 million network‑layer (L3) distributed denial‑of‑service attacks during the third quarter, representing a 38 percent rise from the previous period.

The company’s automated defenses recorded an average of 8,226 L3 attacks each hour, underscoring a relentless flow of malicious traffic aimed at overwhelming target servers and networks. In total, the mitigation effort involved handling roughly 14.4 trillion units of network data associated with those assaults.

Network‑layer attacks focus on saturating bandwidth or exhausting connection tables, often using amplification techniques that multiply the volume of traffic directed at a victim. Because they operate below the application layer, they can be harder to detect with traditional firewall rules, prompting many organizations to rely on specialized mitigation services like Cloudflare’s edge network.

Industry analysts note that the uptick aligns with broader trends in cybercrime, where threat actors exploit low‑cost botnets and increasingly sophisticated command‑and‑control infrastructure. The rise in attack frequency does not necessarily indicate larger attack sizes, but the sheer volume of incidents raises operational challenges for defenders and can increase costs for businesses that must purchase additional protection.

Cloudflare’s report highlights the company’s reliance on autonomous systems that identify and scrub malicious traffic in real time, without human intervention. This approach allows the firm to scale its defenses across millions of web properties, a capability that smaller enterprises often lack. By absorbing the traffic at the edge, Cloudflare helps keep targeted sites online while preserving performance for legitimate users.

Looking ahead, experts expect the pressure on mitigation services to continue as attackers experiment with multi‑vector campaigns that combine network‑layer floods with application‑layer exploits. Organizations are urged to adopt a layered security strategy, regularly audit their exposure, and consider partnering with providers that can offer real‑time, globally distributed protection. Cloudflare’s quarterly data serves as a barometer for the evolving threat landscape, emphasizing that robust, automated defenses are becoming a baseline requirement for maintaining internet resilience.