Last month, someone attempted to launch one of the largest Distributed Denial of Service (DDoS) attacks on record to take down a financial website, according to Cloudflare, an internet infrastructure provider.
The attack involved generating a flood of internet traffic via HTTP browser-based requests. At its peak, the bombardment reached 17.2 million requests per second.
“For perspective on how large this attack was: Cloudflare serves over 25 million HTTP requests per second on average,” the company wrote in a blog post on Thursday. “So peaking at 17.2 million rps, this attack reached 68% of our Q2 average rps rate of legitimate HTTP traffic.”
In total, the attack bombarded the company’s servers with 330 million requests in less than one minute. However, Cloudflare says its automated systems were able to automatically detect and mitigate the flood of traffic.
According to Cloudflare, the incident represented the largest application layer-based DDoS attack publicly known. The previous record holder was a 6 million request-per-second attack Google detected last year.
In 2017, Google also fended off a separate 2.5Tbps DDoS attack believed to be the largest one in history. However, the assault leveraged a different method to bombard the company’s network, so it's measured differently.
Cloudflare sources the 17.2 million rps attack to a 20,000-machine botnet, which is an army of malware-controlled computers. “Based on the bots’ source IP addresses, almost 15% of the attack originated from Indonesia and another 17% from India and Brazil combined, indicating that there may be many malware infected devices in those countries,” the company says.
The same botnet also launched a separate DDoS attack last week against another Cloudflare customer that reached 8 million rps. But again, the company automatically fended off the attack. As a result, Cloudflare is also spinning the incidents as evidence that its automated DDoS protection services are needed.