Israel rises to become the world’s 10th most-attacked location, while attacks exceeding 1 Tbps decline by 69% in Q3 2026.
Cloudflare mitigated 18.2 million network-layer distributed denial-of-service (DDoS) attacks during the third quarter of 2026, marking a 208% year-on-year increase and an average of 8,226 attacks every hour. The findings, published in the company’s Q3 2026 DDoS Threat Report, point to a changing threat landscape in which smaller, short-lived attacks are becoming increasingly common, even as exceptionally large, hyper-volumetric incidents decline.
The report highlights the growing prevalence of low-bandwidth attacks, often launched through inexpensive DDoS-for-hire services, alongside evolving attack techniques and the continued resilience of Internet of Things (IoT) botnets. It also identifies geopolitical developments and trade tensions as factors influencing the locations targeted by threat actors.
For organisations across the Middle East and Africa (MEA), where governments, financial institutions, telecom operators and enterprises increasingly depend on digital infrastructure, the findings underline the need for continuous, automated protection.
“The challenge is no longer limited to defending against occasional, exceptionally large attacks. Organisations are facing an increasingly persistent stream of smaller, faster and more distributed attacks.”
— Ercan Aydin, Area Vice President, Middle East, Turkey & Africa, Cloudflare
Smaller attacks dominate as mega-attacks decline
Of the 18.2 million network-layer attacks mitigated by Cloudflare in Q3, 95.75% lasted less than 10 minutes, while 98% remained below 1 Gbps. These figures suggest that attackers are increasingly relying on frequent, short-duration campaigns designed to disrupt services without requiring massive bandwidth.
In contrast, attacks exceeding 1 Tbps fell sharply to 251 in Q3, compared with 805 in the previous quarter—a 69% decline. Cloudflare associates this reduction with law enforcement action earlier in the year against four major IoT botnets: Aisuru, KimWolf, JackSkid and Mossad.
However, the disruption of these networks has not eliminated the underlying threat. New variants, including Dysphoria and Evooo1Bot, are emerging to fill the gap. Mirai-classified attack activity peaked in August at 57.23 petabytes, including a sustained 49.7-hour attack between August 19 and 21.
Israel enters the top 10 targeted locations
Geopolitical developments also influenced the attack landscape. Israel climbed seven positions to become the world’s 10th most-attacked location in Q3, following sustained DDoS activity in mid-September. The increase coincided with contentious domestic developments ahead of parliamentary elections and the Rosh Hashanah holiday.
The United States reclaimed the top position from China, while Canada rose ten places, from 16th to sixth, amid continuing trade disputes. Indonesia entered the top three, accounting for 2.93% of total attacks.
The report also identifies changes in the industries attracting attention. Media, Production and Publishing remained the most-attacked sector, although its share fell to roughly a quarter of its Q2 level. Internet services moved from 12th to sixth, Consumer Services from 17th to eighth, and Adult Entertainment from 21st to ninth.
Attackers rapidly change techniques
The methods used to launch attacks also shifted during the quarter. Following a surge in CLDAP-based floods during the first half of 2026, these attacks declined by 99.5% quarter-on-quarter, representing just 0.05% of all attacks. Threat actors increasingly turned to DNS amplification, which rose 215%, and other UDP floods, whose share increased from 14.06% to 31.31%.
These techniques exploit connectionless network protocols to overwhelm infrastructure and consume available resources. The rapid change in attack vectors highlights the limitations of security strategies that depend primarily on reactive intervention.
Commenting on the findings, Ercan Aydin, Area Vice President, Middle East, Turkey & Africa at Cloudflare, said organisations must move beyond preparing only for occasional, high-volume incidents. The growing frequency of smaller and faster attacks requires automated detection and mitigation capable of protecting infrastructure without affecting service availability or performance.
Cloudflare says its global network, spanning more than 330 cities and backed by 500 Tbps of capacity, is designed to absorb and mitigate attacks at scale. All services operating on its network receive free, unmetered DDoS protection, with automated detection and mitigation.
The company also offers a free DDoS Botnet Threat Feed for hosting providers, cloud platforms and internet service providers. The feed helps identify abusive IP addresses and accounts involved in launching attacks and has attracted more than 800 participating networks worldwide.
As DDoS activity becomes more frequent and attack methods continue to evolve, the report reinforces a critical point for enterprises: resilience depends not only on the ability to withstand massive attacks, but also on continuously detecting and neutralising smaller, distributed threats before they disrupt essential digital services.
