Massive HTTP DDoS Attack Hits Record High of 71 Million Requests/Second

Feb 14, 2023Ravie Lakshmanan

Web infrastructure company Cloudflare on Monday disclosed that
it thwarted a record-breaking distributed denial-of-service (DDoS)
attack that peaked at over 71 million requests per second
(RPS).

“The majority of attacks peaked in the ballpark of 50-70 million
requests per second (RPS) with the largest exceeding 71 million,”
the company said^[1], calling it a
“hyper-volumetric” DDoS attack.

It’s also the largest HTTP DDoS attack reported to date, more
than 35% higher than the previous 46 million RPS DDoS attack that
Google Cloud mitigated in June
2022^[2].

Cloudflare said the attacks singled out websites secured by its
platform and they emanated from a botnet comprising more than
30,000 IP addresses that belonged to “numerous” cloud
providers.

Targeted websites included a popular gaming provider,
cryptocurrency companies, hosting providers, and cloud computing
platforms.

HTTP attacks of this kind are designed to send a tsunami of HTTP
requests toward a target website, typically in order of magnitude
higher than what the website can handle, with the goal of rendering
it inaccessible.

“Given a sufficiently high amount of requests, the website’s
server will not be able to process all of the attack requests along
with the legitimate user requests,” Cloudflare said.

“Users will experience this as website-load delays, timeouts,
and eventually not being able to connect to their desired websites
at all.”

The development comes as the size, sophistication, and frequency
of DDoS attacks are on the rise, with the company recording^[3]
a 79% spike in HTTP DDoS attacks year-over-year in the final
quarter of 2022.

What’s more, the number of volumetric attacks lasting more than
three hours surged by 87% when compared to the previous three-month
period.

Some of the major attacked industry verticals during the time
period include aviation, education, gaming, hospitality, and
telecom. Georgia, Belize, and San Marino emerged as some of the top
countries targeted by HTTP DDoS attacks in Q4 2022.

Network-layer DDoS attacks, on the other hand, singled out
China, Lithuania, Finland, Singapore, Taiwan, Belgium, Costa Rica,
the U.A.E, South Korea, and Turkey.