Cloudflare thwarts 17.2M rps DDoS attack — the largest ever reported

Cloudflare reports record 17.2 million rps HTTP DDoS attack

Cloudflare's autonomous edge DDoS protection systems detected and blocked a 17.2 million request-per-second (rps) HTTP DDoS attack earlier this summer, the company said. The attack is nearly three times larger than any previously reported HTTP DDoS attack. For context, Cloudflare's average rate of legitimate HTTP traffic in Q2 2021 was 25 million requests per second, meaning the attack peaked at roughly 68% of that baseline.

The attack targeted a Cloudflare customer in the financial industry. Within seconds, the botnet generated over 330 million attack requests from more than 20,000 bots spread across 125 countries. Analysis of the source IP addresses showed that nearly 15% of the traffic originated from Indonesia, with another 17% coming from India and Brazil combined, suggesting significant malware infection rates in those regions.

How the autonomous mitigation works

Cloudflare's DDoS protection is powered by a home-grown daemon called dosd. A dedicated instance runs on every server in each of Cloudflare's data centers. Each instance independently samples and analyzes traffic out-of-path, allowing for asynchronous scanning that does not introduce latency or degrade performance. Threat intelligence detected by one instance is shared with others within the same data center.

When an attack is identified, the system generates a mitigation rule with a real-time signature matching the attack pattern. The rule is then propagated to the most efficient layer in the stack. For volumetric HTTP floods, blocking at L4 through the Linux iptables firewall is preferred over responding with a 403 error at L7 in the reverse proxy. Because the drop happens lower in the stack, edge CPU consumption and intra-data center bandwidth usage are minimized, enabling large-scale mitigation without affecting performance of legitimate traffic.

This fully automated approach means no manual intervention by Cloudflare personnel is required, even for attacks that hit 68% of the network's average request-per-second rate or higher.

Signs of stronger botnets

The 17.2 million rps attack is not an isolated event from this specific botnet. According to Cloudflare, the same botnet previously targeted a hosting provider with a roughly 8 million rps HTTP DDoS attack. Two weeks before that, a Mirai-variant botnet launched a dozen UDP- and TCP-based attacks exceeding 1 Tbps, with a maximum peak of about 1.2 Tbps. While the HTTP attacks hit customers on the WAF/CDN service, the network-layer attacks targeted users of Magic Transit and Spectrum, including a major APAC-based Internet services, telecommunications and hosting provider, as well as a gaming company.

During the Mirai-variant campaign, the botnet fleet declined from roughly 30K to 28K bots, yet it still generated significant attack volumes in short bursts, some lasting only a few seconds.

The broader trend appears to be accelerating. In July alone, Cloudflare observed an 88% increase in L3/4 Mirai-based attacks and a 9% increase in L7 attacks. Based on the current August daily average, Cloudflare projects L7 Mirai and similar botnet attacks will rise by 185% and L3/4 attacks by 71% by the end of August. The short-duration nature of many of these attacks makes them particularly dangerous for legacy protections or organizations relying on stand-by mitigation, since a burst may be over before a human analyst can respond.

What is Mirai

Mirai, meaning "future" in Japanese, is malware first documented in 2016 by the non-profit security research group MalwareMustDie. It propagates by infecting Linux-powered devices such as security cameras and routers, scanning for open Telnet ports 23 and 2323. Once a vulnerable device is located, the malware brute-forces known credentials, including factory-default usernames and passwords. Later variants expanded their reach by exploiting zero-day vulnerabilities in routers and other hardware. Infected devices then poll a Command & Control (C2) server for instructions on target selection. After infection, the malware self-propagates to find additional vulnerable devices.

Defense recommendations

For businesses, Cloudflare recommends onboarding to its network since DDoS protection is enabled by default, while noting that protection settings can be customized. Additional best practices include allowing only traffic from Cloudflare's IP ranges at the origin and ideally applying an access control list at the upstream ISP to prevent attackers from directly targeting origin IP addresses. These steps are detailed in Cloudflare's preventive best practices guidance.

For home users, the key recommendations are to change default usernames and passwords on Internet-connected devices like routers and smart cameras, reducing the risk of Mirai infection. Cloudflare also suggests using Cloudflare for Families, a free DNS service that filters out malicious websites and blocks malware command-and-control communications at the network level.