Cloudflare mitigated 18.2 million network-layer DDoS attacks during Q3, while Israel moved up seven positions to become the world’s 10th most-attacked location.
Cloudflare has released its Q3 2026 DDoS Threat Report, revealing a sharp increase in distributed denial-of-service (DDoS) attacks worldwide. The company mitigated 18.2 million network-layer DDoS attacks during the quarter, marking a 208% year-over-year increase and an average of 8,226 attacks every hour.
The report identifies a shift in the DDoS threat landscape, with smaller, shorter-lived attacks, described as “swarms”, becoming increasingly common. At the same time, exceptionally large, high-volume attacks, referred to as “giants”, have declined.
The findings also highlight changing attack techniques, the continued resilience of Internet of Things (IoT) botnets and the influence of geopolitical developments on attack targets.
For organisations across the Middle East and Africa (MEA), including government bodies, financial institutions, telecommunications providers and enterprises undergoing digital transformation, the findings underline the importance of continuous protection for networks and critical digital infrastructure.
Israel Rises Among the World’s Most-Attacked Locations
One of the report’s key regional findings is the increase in DDoS activity targeting Israel. The country moved up seven positions to become the world’s 10th most-attacked location in Q3 2026, following sustained attack activity in mid-September.
The increase coincided with contentious domestic developments ahead of parliamentary elections and the Rosh Hashanah holiday, alongside a broader rise in hostile cyber activity targeting the country.
The United States also reclaimed its position as the world’s most-attacked location from China. Canada climbed ten places, moving from 16th to sixth amid ongoing trade disputes. Indonesia entered the top three, accounting for 2.93% of total attacks.
DDoS Attacks Increase as Large-Scale Incidents Decline
Cloudflare’s report shows that although the overall number of attacks has increased significantly, exceptionally large incidents have become less frequent. Many of the attacks are inexpensive to launch, last for relatively short periods and can still disrupt online services.
Key findings from the report include:
- Smaller and Faster Attacks: Cloudflare mitigated 18.2 million network-layer DDoS attacks in Q3 2026, representing a 208% year-over-year increase. Around 95.75% of these attacks ended within 10 minutes, while 98% remained below 1 Gbps, reflecting the activity commonly associated with DDoS-for-hire “booter” services.
- Decline in Hyper-Volumetric Attacks: Attacks exceeding 1 Tbps dropped to 251 in Q3, compared with 805 in Q2, a decline of 69%. This coincided with law enforcement takedowns of four major IoT botnets earlier in the year: Aisuru, KimWolf, JackSkid and Mossad.
- IoT Botnets Remain Active: New variants, including Dysphoria and Evooo1Bot, are emerging to fill the gap. Mirai-classified mitigation activity peaked in August at 57.23 PB, including an attack lasting 49.7 hours between August 19 and 21.
- Changes in Attack Methods: CLDAP floods, which increased during the first half of 2026, declined by 99.5% quarter over quarter to account for just 0.05% of attacks. Attackers shifted towards DNS amplification, which increased by 215%, and other UDP floods, whose share rose from 14.06% to 31.31%.
- Geopolitical Developments Influence Targets: The United States regained the top position from China, Canada moved from 16th to sixth, and Israel climbed seven places to 10th.
- More Industries Face Attacks: Media, Production and Publishing remained the most-targeted industry, although its share fell to roughly a quarter of its Q2 level. Internet moved from 12th to sixth, Consumer Services from 17th to eighth, and Adult Entertainment from 21st to ninth.
Evolving Attack Techniques Present New Challenges
The report identifies a notable change in the techniques used by threat actors. Following a substantial rise in CLDAP-based attacks during the first half of 2026, attackers increasingly turned to DNS amplification and other UDP-based flooding methods.
These techniques exploit connectionless protocols to overwhelm network infrastructure and consume available resources. The shift demonstrates how quickly attackers can change their methods, creating challenges for organisations that depend on traditional, reactive security measures.
Although attacks exceeding 1 Tbps declined substantially during Q3, the appearance of new IoT botnet variants indicates that the underlying threat remains active. The continued presence of Mirai-classified attacks also demonstrates how compromised connected devices can contribute to large-scale attack infrastructure.
Cloudflare Highlights the Need for Stronger DDoS Resilience
“Cloudflare’s latest findings highlight an important shift in the way organisations need to think about DDoS protection. The challenge is no longer limited to defending against occasional, exceptionally large attacks. We are seeing an increasingly persistent stream of smaller, faster and more distributed attacks, often designed to overwhelm infrastructure before security teams have time to respond,” said Ercan Aydin, Area Vice President, Middle East, Turkey & Africa at Cloudflare.
“For organisations across the Middle East, Turkey and Africa, this is particularly relevant as digital services become central to economic growth, customer engagement and national transformation programmes. Businesses need to move beyond reactive defences and adopt an approach that can automatically detect and mitigate attacks at scale, without compromising the availability and performance of their digital services. At Cloudflare, our global network and autonomous security capabilities enable organisations to strengthen their resilience against an increasingly dynamic threat landscape,” said Aydin.
Cloudflare’s network is designed to absorb and mitigate DDoS attacks at scale. It spans more than 330 cities and is supported by 500 Tbps of network capacity. All services operating on its network receive free, unmetered DDoS protection, with automated detection and mitigation functioning without human intervention.
The company also offers a free DDoS Botnet Threat Feed for hosting providers, cloud computing platforms and Internet service providers. The feed helps these organisations identify and take action against abusive IP addresses and accounts involved in launching attacks. More than 800 networks worldwide have signed up for the service.
As attack volumes continue to rise and threat actors diversify their methods, Cloudflare’s Q3 findings highlight the growing importance of automated, network-wide protection to maintain the availability, performance and security of critical digital services.