Starting in Q2 2025, we changed our methodology for analyzing DDoS attacks. Previously, we considered network- and transport-layer attacks (L3-L4 DDoS) and application-layer attacks (L7 DDoS) separately. We now use a unified approach based on incidents, which can include multiple attacks across different vectors.
We filter out L3-L4 DDoS attacks with an intensity below 1 Gbps, considering them background noise. For L7 DDoS attacks, we also apply threshold criteria: at least 100 blocked IP addresses and a rate of at least 1,000 requests per second. Multiple attack waves are grouped into a single incident if the time gap between them does not exceed one hour.
For the first time in several quarters, the leading DDoS attack vector changed in Q3 2026. UDP flood took the top spot at 50.2%, while HTTP ranked second at 39.8%. Together, these two attack vectors accounted for 90% of all attacks.
The share of multivector attacks decreased significantly in Q3 2026, from 11.7% of all recorded incidents in the previous quarter to 6.8%. However, the share of multivector attacks combining L3-L4 and L7 increased slightly, from 3.6% in Q2 to 4.1% in Q3.
The primary targets of DDoS attacks in Q3 2026 were organizations in the FinTech (31.3%), E-commerce (19.0%), and Information and communication technology (18.2%) segments. Together, these three segments accounted for more than two-thirds of all incidents we observed.
They were followed by the Games (8.1%) and Betting (7.6%) segments. Despite the final stages of the FIFA World Cup taking place in July, DDoS activity in the Betting segment remained lower than we expected.
At the microsegment level, Trading platforms (12.0%), Software services (11.8%), Banks (8.3%), Betting shops (7.6%), and Online retail (6.0%) accounted for the largest shares of DDoS attacks in Q3 2026. Together, the top five microsegments accounted for nearly half (45.7%) of all incidents.
The longest DDoS attacks observed in Q3 2026 targeted organizations in the Banks (200.0 hours), Media, TV, radio, and bloggers (75.3 hours), and Gambling (35.9 hours) segments. The maximum attack duration was 2.5 times higher than in the previous quarter (79.9 hours) and significantly exceeded the 2025 record of 119.2 hours.
The average duration of DDoS attacks continued to decline, from 2,764 seconds in Q2 to 1,571 seconds in Q3. The median duration also decreased, from 150 to 120 seconds, returning to the Q1 level.
The two highest-bandwidth L3-L4 DDoS attacks observed in Q3 2026 targeted organizations in the Telecom operators (1.38 Tbps) and Game servers (1.36 Tbps) microsegments.
The top five also included Betting shops (771.6 Gbps), Gambling (651.7 Gbps), and Software services (628.6 Gbps).
The highest packet rates in Q3 2026 were recorded in attacks targeting organizations in the Gambling (298.7 Mpps), Marketplaces (295.2 Mpps), Game servers (140.2 Mpps), Telecom operators (120.9 Mpps), and Online retail (95.0 Mpps) microsegments.
In the previous quarter, the largest botnet we observed while mitigating L7 DDoS attacks shrank sharply, from a record 13.5 million devices in Q1 2026 to 2.09 million in Q2. One possible factor behind this decline was a joint operation conducted in March by law enforcement agencies in the United States, Canada, and Germany to disrupt infrastructure used by major botnets, including Aisiru and Kimwolf.
At the same time, we noted that the fundamental drivers of botnet growth remained unchanged: the number of vulnerable devices worldwide continues to increase, while AI-powered automation simplifies and accelerates their discovery and compromise. We therefore expected the decline to be temporary and the largest botnets to start growing again.
Our prediction began to materialize in Q3 2026: the largest botnet we observed grew to 3.56 million devices, an increase of around 70% compared with the previous quarter.
Brazil accounted for the largest share of devices in the botnet at 16.4%, followed by India (5.5%), Russia (5.2%), Argentina (4.6%), and the United States (4.0%). Overall, the botnet’s geographic distribution became more even compared with the previous quarter.
Beyond their renewed growth, botnets are also evolving in how they are controlled. One notable trend we observed in 2026 is the use of public blockchains as decentralized C2 channels. Botnets such as Aeternum and Void use smart contracts deployed on the Polygon and Ethereum blockchains, respectively, to distribute commands or information about additional infrastructure. Unlike a conventional C2 server, such a command channel has no single server that can simply be seized or taken offline, making traditional botnet takedowns more challenging.
We expect the largest botnets to continue growing and likely to return to the levels we observed at the beginning of the year in the foreseeable future.
The top five source countries for L7 DDoS attacks in Q3 2026 were the United States (16.7%), Brazil (8.7%), Russia (6.7%), Vietnam (5.2%), and India (3.1%).
The trend toward a more even geographic distribution of L7 DDoS attack sources continued in Q3 2026. The top five countries accounted for 40.4% of all blocked IP addresses, down from 41.9% in the previous quarter. Meanwhile, the combined share of “other” countries — those outside the top 20 — increased from 29.8% to 32.6%.
This suggests that DDoS attackers continue to diversify their infrastructure geographically. As a result, simple geoblocking is becoming less effective at mitigating large-scale DDoS attacks.
“Bad bots” refer to automated systems that attempt to interact with websites while impersonating real users. Their typical objectives include data scraping, metric manipulation, credential stuffing, and other forms of unwanted activity. However, unlike destructive DDoS bots, bad bots usually do not aim to disrupt website availability.
In Q3 2026, the average monthly number of blocked bad bot requests remained almost unchanged from the previous quarter, at around 1.8 billion.
This moderate level of bot activity was largely seasonal, reflecting the traditional summer slowdown, followed by a slight pickup in September.
The largest share of bad bot attacks in Q3 2026 targeted the E-commerce segment (55.60% of all bot activity), which traditionally attracts the most attacks. Media ranked second at 15.32%, while Betting came in third at 8.94%.
Across all protected resources, the average share of bot traffic in total traffic (hereafter, the “bot index”) was 1.53% in Q3 2026, slightly below the 1.56% observed during the previous quarter. The highest bot index values were recorded in the EdTech (21.35%), Transport&Logistics (6.79%), and Media (6.41%) segments.
It should be noted that Qrator.AntiBot allows customers to configure where protection is applied, including specific pages and domains. As a result, the bot index we calculate may not account for a significant portion of bot traffic targeting a protected resource.
The distribution of bots by type remained virtually unchanged in Q3 2026 compared with the previous quarter. Simple scripted bots continued to account for the largest share (50.80% → 50.60%). The share of puppeteer bots — bots that imitate a human user environment while being controlled through external automation — increased slightly (3.15% → 3.22%). Smart bots, which are aware of detection mechanisms and attempt to bypass them, decreased slightly (0.57% → 0.50%). The share of API bots remained almost unchanged (45.48% → 45.58%).
The most intense attack mitigated by Qrator.AntiBot in Q3 2026 targeted an organization in the Betting segment. It was an application-layer (L7) DDoS attack that peaked at around 22,000 malicious requests per second.
The longest bot attack observed in Q3 2026 targeted an organization in the E-commerce segment. Its active phase lasted around 6.5 days, during which we blocked approximately 60 million malicious requests. Bot activity targeting the organization continued afterward, but at a much lower level.
In Q3 2026, the number of unique ASes responsible for route leaks decreased slightly, by approximately 6.4% year over year.
The number of unique BGP hijackers also continued to decline, with the pace of the decrease accelerating slightly compared with the corresponding periods of the previous year. Their number fell by 10.4% year over year in Q1 2026, by 34.2% in Q2, and by 38.2% in Q3.
We attribute this decline to significant progress in the deployment of RPKI ROA, the mechanism that can efficiently prevent such incidents. Earlier this year, the pace of RPKI ROA deployment accelerated considerably, contributing substantially to this sharp decline. Deployment has since slowed to a more moderate pace, so we expect the decrease in the number of unique BGP hijackers to slow as well in the coming quarters.
At the same time, mechanisms designed to prevent route leaks — RFC 9234 and ASPA — are still in the early stages of deployment. As a result, the number of BGP incidents of this type remains stable.
As for global BGP incidents, Q3 2026 saw an unusually high number: we recorded a total of 11 global route leaks and one global BGP hijack.
To identify global BGP incidents, the Qrator.Radar team applies a set of threshold criteria, including the number of affected prefixes and ASes, as well as the extent to which the anomaly propagates across routing tables.
One BGP incident in Q3 2026 deserves particular attention. It involved an intentional BGP hijack that was used as part of a supply chain attack targeting customers of Softaculous, the developer of the Virtualizor virtual machine management platform.
The attackers announced a more-specific route for part of the address space belonging to German hosting provider Hetzner, where Softaculous infrastructure, including the Virtualizor update server, was hosted. Due to the way the ROA for this address space was configured, the malicious route was RPKI-valid and propagated widely across the Internet. This allowed the attackers to redirect some traffic intended for Softaculous, obtain a valid TLS certificate for the company’s domains, and ultimately distribute a malicious Virtualizor update to a number of its customers.
Share your experience and expectations regarding DDoS protection. Your answers will help us tailor solutions to meet your cybersecurity needs.
Tell us about your company’s infrastructure and critical systems. This will help us understand the scope of protection you require.
Help us learn about how decisions are made in your company. This information will guide us in offering the most relevant solutions.
Let us know what drives your choices when it comes to DDoS protection. Your input will help us focus on what matters most to you.
