Record HTTPS DDoS Attack Peaks at 15.3 Million Requests Per Second
Cloudflare's automated DDoS mitigation systems detected and blocked a 15.3 million request-per-second (rps) HTTPS DDoS attack earlier this month, marking one of the largest encrypted application-layer attacks ever recorded. Although the company has previously mitigated larger HTTP-based attacks, this particular incident stands out due to the computational cost associated with launching and defending against HTTPS traffic, which requires the overhead of establishing TLS-encrypted connections.
The attack lasted less than 15 seconds and targeted a Cloudflare customer on the Professional (Pro) plan operating a crypto launchpad, a platform used to introduce Decentralized Finance projects to potential investors. According to Cloudflare, the botnet responsible for the attack had been previously observed; the company had already seen similar assaults reaching up to 10M rps with the same attack fingerprint. Cloudflare states that its customers are already protected against this botnet and require no additional action.
Attack Traffic Originated from Data Centers
Unlike many botnet attacks that rely on compromised residential internet connections, this assault drew its traffic primarily from data centers and cloud compute providers. The botnet consisted of roughly 6,000 unique bots distributed across 112 countries. Indonesia was the largest source of traffic, accounting for nearly 15 percent of the attack, followed by Russia, Brazil, India, Colombia, and the United States.
The traffic traversed more than 1,300 distinct networks. Notably, the top contributors were cloud providers, including Hetzner Online GmbH (ASN 24940) in Germany, Azteca Comunicaciones Colombia (ASN 262186), and OVH in France (ASN 16276).
Autonomous Detection and Mitigation
Cloudflare's defense architecture is fully software-defined and operates autonomously, detecting and mitigating DDoS attacks across its entire network without human intervention. The process begins with asynchronous traffic sampling at any of the company's data centers, which are distributed across over 240 cities worldwide. This out-of-path sampling method allows for traffic analysis without adding latency.
Once sampled, HTTP request data is analyzed using streaming algorithms. The system compares request samples against conditional fingerprints and generates real-time signatures by dynamically masking various request fields and metadata. Each time a request matches an existing signature, a counter increments. When the counter reaches an activation threshold, the system compiles a mitigation rule and pushes it inline to enforce the appropriate action, such as blocking the traffic.
The company recommends that customers familiarize themselves with HTTP DDoS Managed Rules, which allow for customization of the automatic DDoS protection settings.
Cloudflare emphasized that its DDoS protection is unmetered and unlimited, not constrained by attack size, frequency, or duration. This approach is particularly relevant given the recent uptrend in both the frequency and scale of DDoS attacks. The company's autonomous DDoS protection systems are described in greater detail in a deep-dive technical blog post.
