Indonesia rose to third place among the locations most targeted by distributed denial-of-service attacks in the third quarter of 2026, according to Cloudflare’s latest DDoS threat report.
The country accounted for 2.93 percent of attacks in Cloudflare’s ranking, behind the United States and China. Vietnam remained in the global top 10 at ninth place, down from seventh in the previous quarter.
The ranking reflects attacks observed and mitigated across Cloudflare’s network. It should not be read as a measure of attacks against Indonesia as a state. Under Cloudflare’s methodology, target-country data is grouped by customers’ billing countries, and the ranking combines application-layer and network-layer attack indicators, including attack volumes and the share of malicious traffic.
Short attacks rise sharply
Cloudflare said it automatically mitigated 18.2 million network-layer DDoS attacks during the July-to-September quarter, equivalent to about 8,226 attacks an hour. It also recorded 14.4 trillion HTTP DDoS requests.
Mitigated traffic totaled 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer. These totals describe traffic handled by Cloudflare’s infrastructure rather than losses, outages or attempted attacks measured across the entire internet.
The network-layer attack count increased 208 percent from the same period a year earlier. Nearly 96 percent of those attacks ended within 10 minutes, while 98 percent stayed below one gigabit per second.
Cloudflare said the combination of short duration, modest bandwidth and high frequency was consistent with DDoS-for-hire services, sometimes called booter services. These services allow customers to pay for automated attacks intended to overwhelm a website, server or internet service.
The company cautioned that an attack below one gigabit per second can still disrupt a server or website, particularly when the target has limited capacity or faces repeated bursts. Cloudflare’s figures cover attacks detected by its systems and do not represent an independently audited count of all DDoS activity worldwide.
Largest attacks decline
While the total number of network-layer attacks climbed, attacks exceeding one terabit per second fell to 251 in the third quarter from 805 in the second quarter, a decline of nearly 69 percent.
Cloudflare said the decline coincided with law enforcement action earlier in the year against four large internet-of-things botnets: Aisuru, KimWolf, JackSkid and Mossad. The report presented the enforcement action as a possible factor rather than proof of direct causation.
In March, the U.S. Justice Department said it had joined authorities in Canada and Germany in disrupting command-and-control infrastructure used by the four botnets. Court documents cited by the department said the networks had infected millions of devices and launched hundreds of thousands of attacks.
Cloudflare nevertheless said internet-of-things botnets remained a significant threat as new variants emerged. Traffic it classified as Mirai-related peaked in August at 57.23 petabytes and included a sustained attack lasting 49.7 hours from August 19 to August 21.
Attack techniques shift
The report also recorded a sharp change in attack methods. Connectionless Lightweight Directory Access Protocol floods fell 99.5 percent from the second quarter and represented 0.05 percent of network-layer attacks in the third quarter.
DNS amplification attacks rose 215 percent and accounted for 3.43 percent of network-layer attacks. Other User Datagram Protocol floods increased from 14.06 percent to 31.31 percent of the total.
Both DNS amplification and other UDP-based floods can exploit connectionless protocols to direct large volumes of traffic toward a target. The rapid change between techniques suggests attackers can shift to alternative tools when a particular method becomes less effective or more exposed.
Media, production and publishing remained the most-attacked industry in Cloudflare’s data, although its share fell to about one-quarter of its second-quarter level. Internet businesses rose to sixth place, while consumer services climbed to eighth.
More than 40 Indonesian agencies hit by cyberattack on data centers – report