Back to attack reports

Attack Reports

TMW Attack Report, September 2026

2026-10-22 · 4 min

9,007 mitigated events from September 1–30, 2026 (Europe/Berlin). UDP Flood led with 7,470 events. Peak packet rate reached 46.85 Mpps and peak bitrate approximately 170 Gbps. Destination addresses are omitted.

  • 9,007 attacks mitigated, September 1–30 (Europe/Berlin)
  • Peak intensity: 46.85 Mpps; peak bitrate: approximately 170 Gbps
  • Leading vector: UDP Flood, 7,470 events
  • Transport: UDP 8,756 events; TCP 251 events

What Shield handled in 30 days.

September 1–30, 2026 (Europe/Berlin) · All mitigated

attacks

9,007

September 1–30, 2026 (Europe/Berlin)

Leading vector

UDP Flood

7,470 events, 83% of the window

Dominant transport

UDP

8,756 events, 97% of the window

Peak intensity

46.8 Mpps

Highest packet rate observed in the window

Attack type

9,007

attacks

September 1–30, 2026 (Europe/Berlin)

  • UDP Flood7,470 · 83%
  • Fragment Flood1,275 · 14%
  • TCP SYN163 · 2%
  • TCP ACK-PSH Flood29 · <1%
  • SYN-ACK25 · <1%
  • Other43 · <1%

Transport

Protocol family share

9,007 attacks

UDP 97%
  • UDP8,756 · 97%
  • TCP251 · 3%

Top ports

Most targeted service ports

  • 27015 Game service599 attacks
  • 28015 Game service357 attacks
  • 29015 Game service316 attacks
  • 19132 Minecraft279 attacks
  • 22 SSH214 attacks

Peak packet rate

Highest observed intensity. Destinations omitted.

46.8 Mpps

#1

35.2 Mpps

#2

20.5 Mpps

#3

17.7 Mpps

#4

14.6 Mpps

#5

Target mix

Share of events by destination rank. Addresses are not published.

  1. Rank 1

    718

    8%

  2. Rank 2

    313

    3%

  3. Rank 3

    81

    1%

  4. Rank 4

    65

    1%

  5. Rank 5

    63

    1%

  6. All others

    7,767

    86%

Executive summary

TMW Shield recorded 9,007 mitigated events from September 1 through September 30, 2026, using the Europe/Berlin calendar window. The export was dominated by UDP Flood and Fragment Flood events.

The five most frequently targeted anonymous destinations recorded 718, 313, 81, 65 and 63 events. Only aggregate counts are published; customer destination addresses and identifiers are omitted.

Vector and transport mix

The exported vector breakdown lists UDP Flood 7,470, Fragment Flood 1,275, TCP SYN 163, TCP ACK-PSH 29, SYN-ACK 25 and Other 43.

These vector counts sum to 9,005, two fewer than the 9,007-event total. This discrepancy is retained as exported; no vector is invented or assigned to the missing two events.

The transport breakdown reconciles to the full total: UDP 8,756 events and TCP 251 events.

Ports and intensity

The most targeted destination ports were 27015 (599 events), 28015 (357), 29015 (316), 19132 (279) and SSH port 22 (214). These are aggregate port counts, not destination identities.

The five highest packet-rate peaks were 46,848,852, 35,193,944, 20,532,516, 17,734,470 and 14,585,735 packets per second. The highest is approximately 46.85 Mpps.

Peak bitrate reached 169.996551496 Gbps, approximately 170 Gbps. Packet-rate and bitrate maxima are reported separately and are not asserted to belong to the same event.

Recommendations

Keep always-on Shield on prefixes hosting UDP games and voice services. UDP traffic dominated this reporting window.

Restrict SSH and administrative access. Port 22 was among the five most targeted destination ports.

Handle volumetric floods at the scrubbing edge rather than relying on origin firewalls to absorb tens of millions of packets per second.

Need help interpreting your own attack telemetry or designing filter policy? Our NOC publishes these reports to help operators prepare before the next flood.

Contact engineering