Peacemaker Threat Landscape Q3 2026: Germany

1,103,410,265 threats blocked in Q3 2026

That is about 12.3 million blocked requests on German ISP networks every day, and 36% of the 3.1 billion threats Whalebone stopped across six European markets in the quarter. Every one of them was a device inside an ISP's network reaching for a malicious domain.

What you will find in the report:

What German networks blocked: malware 56%, blacklist 30%, phishing 12%, and other 2%
Three global threat domains Whalebone blocked in every market it monitors
Local threat of the quarter: fake local news sites built to trap German readers

Why it matters for ISPs

Malware works in the background: infected devices contact their servers automatically and repeatedly.
Every one of those contacts is a DNS request, which is why malware outnumbers the phishing people actually notice.
Whalebone Peacemaker blocks the DNS request before the page loads, so the customer never reaches the site.

Local threat of the quarter

Fake local news sites targeting German readers. A coordinated cluster of short-lived sites impersonated local German news media. The cluster delivered social engineering and malware campaigns, trapping both corporate and private users through deceptive browser prompts. Sites like it are rotated quickly, so new look-alikes keep appearing.

Domain, defanged for safety: medienjournal24[.]click

About the report

Where does the data come from?

Whalebone threat intelligence: DNS requests blocked on customer networks in Germany in Q3 2026 (UTC). Shares are of all blocked threats in the market and are rounded to whole percent.

Do I need to fill in a form?

No. The report is free to download, no registration needed.

How can my ISP get the same protection?

Start a free 30-day trial of Whalebone Peacemaker at whalebone.io/peacemaker-trial.