Latest Cloudflare DDoS Threat Report reveals a surge in smaller, faster attacks, while Israel climbs to become the world’s 10th most-attacked location.
Dubai, UAE, November, 2026 – Cloudflare, the leading connectivity cloud company, has released its Q3 2026 DDoS Threat Report, revealing a significant escalation in the frequency of distributed denial-of-service (DDoS) attacks globally. Cloudflare mitigated 18.2 million network-layer DDoS attacks during the quarter, representing a 208% increase year-on-year and an average of 8,226 attacks every hour. The report highlights a growing number of smaller, short-lived attacks – or “swarms” – even as exceptionally large, hyper-volumetric attacks, referred to as “giants”, have declined.
The findings highlight a changing DDoS threat landscape, characterised by a growing number of short-duration, lower-bandwidth attacks rather than exclusively large-scale, high-volume incidents. The report also identifies changing attack techniques, the continued resilience of IoT botnets and the influence of geopolitical developments on attack targets.
For organisations across the Middle East and Africa (MEA), where governments, financial institutions, telecommunications providers and enterprises are accelerating digital transformation, the findings reinforce the importance of having always-on protection for networks and critical digital infrastructure.
Israel emerges among the world’s most-attacked locations:
One of the report’s notable regional findings is the rise in attacks targeting Israel. The country climbed seven positions to become the world’s 10th most-attacked location in Q3, following sustained DDoS activity in mid-September.
The increase coincided with contentious domestic developments ahead of parliamentary elections and the Rosh Hashanah holiday, as well as a broader rise in hostile cyber activity targeting the country.
The United States reclaimed the position of the world’s most-attacked location from China, while Canada climbed ten places, from 16th to sixth, amid ongoing trade disputes. Indonesia also entered the top three, accounting for 2.93% of total attacks.
More attacks, but fewer large-scale incidents
Cloudflare’s findings show more attacks than ever, with far fewer large ones. The report highlights the growing prevalence of attacks that are inexpensive to launch, relatively short-lived and capable of disrupting online services.
Some key stats include:
- Smaller, Faster, More Numerous: Cloudflare mitigated 18.2 million network-layer DDoS attacks in Q3 2026, up 208% year-over-year. 95.75% ended in under 10 minutes and 98% stayed under 1 Gbps – the signature of DDoS-for-hire “booter” services.
- Hyper-Volumetric Attacks Plunge: Attacks exceeding 1 Tbps fell to 251 in Q3 from 805 in Q2 (-69%), coinciding with law enforcement’s takedown of four major IoT botnets (Aisuru, KimWolf, JackSkid, and Mossad) earlier this year.
- IoT Botnets Remain Durable: New variants like Dysphoria and Evooo1Bot are filling the gap. Mirai-classified mitigation peaked in August at 57.23 PB, including a 49.7-hour attack between August 19 and 21.
- Attack Vector Whiplash: After surging in the first half of the year, CLDAP floods collapsed 99.5% QoQ to just 0.05% of attacks. Attackers pivoted to DNS Amplification (+215%) and other UDP Floods (14.06% to 31.31% of attacks).
- Geopolitics and Trade Tensions Shift Targets: The U.S. reclaimed the #1 most-attacked spot from China. Canada jumped 10 places (#16 to #6) amid trade disputes, and Israel climbed 7 spots to #10 amid mid-September DDoS activity ahead of parliamentary elections.
- Attackers Broaden Their Aim: Media, Production & Publishing remained the #1 most-attacked industry, but its share fell to roughly a quarter of its Q2 level. Internet (#12 to #6), Consumer Services (#17 to #8), and Adult Entertainment (#21 to #9) all climbed.
Changing attack techniques create new challenges:
The report also identifies a significant shift in the methods used by attackers. Following a substantial increase in CLDAP-based attacks during the first half of 2026, threat actors moved towards DNS amplification and other UDP-based floods.
These techniques exploit connectionless protocols to overwhelm network infrastructure and consume available resources. The shift demonstrates how quickly attackers can adapt their methods, making it increasingly difficult for organisations relying on traditional, reactive security approaches to maintain protection.
Although the number of attacks exceeding 1 Tbps declined substantially in Q3, the emergence of new IoT botnet variants demonstrates that the underlying threat remains. The persistence of Mirai-classified attacks further highlights the potential for compromised connected devices to be used as part of large-scale attack infrastructure.
Building resilience against an evolving threat landscape:
“Cloudflare’s latest findings highlight an important shift in the way organisations need to think about DDoS protection. The challenge is no longer limited to defending against occasional, exceptionally large attacks. We are seeing an increasingly persistent stream of smaller, faster and more distributed attacks, often designed to overwhelm infrastructure before security teams have time to respond,” said Ercan Aydin, Area Vice President, Middle East, Turkey & Africa at Cloudflare.
“For organisations across the Middle East, Turkey and Africa, this is particularly relevant as digital services become central to economic growth, customer engagement and national transformation programmes. Businesses need to move beyond reactive defences and adopt an approach that can automatically detect and mitigate attacks at scale, without compromising the availability and performance of their digital services. At Cloudflare, our global network and autonomous security capabilities enable organisations to strengthen their resilience against an increasingly dynamic threat landscape,” said Aydin.
Cloudflare’s network is designed to absorb and mitigate DDoS attacks at scale. Its services benefit from a global network spanning more than 330 cities, backed by 500 Tbps of network capacity. All services on its network receive free, unmetered DDoS protection, with automated detection and mitigation operating without human intervention.
The company also provides a free DDoS Botnet Threat Feed for hosting providers, cloud computing platforms and internet service providers, helping them identify and take action against abusive IP addresses and accounts responsible for launching attacks. More than 800 networks worldwide have signed up for the feed.
As attack volumes continue to rise and threat actors diversify their techniques, the Q3 findings underscore the importance of automated, network-wide protection in maintaining the availability, performance and security of critical digital services.
Photo Caption: Ercan Aydin, Area Vice President, Middle East, Turkey & Africa at Cloudflare.
About Cloudflare:
Cloudflare, Inc. (www.cloudflare.com / @cloudflare) is on a mission to help build a better Internet. Cloudflare’s suite of products protect and accelerate any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare have all web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures 2018 list and ranked among the World’s Most Innovative Companies by Fast Company in 2019. Headquartered in San Francisco, CA, Cloudflare has offices in Austin, TX, Champaign, IL, New York, NY, San Jose, CA, Seattle, WA, Washington, D.C., Toronto, Lisbon, London, Munich, Paris, Beijing, Singapore, Sydney, and Tokyo.
