Cloudflare logs the biggest DDoS attack on record: 7.3 Tbps in 45 seconds
In mid-May 2025, Cloudflare said it absorbed and blocked the most voluminous DDoS attack it has ever seen, and the largest publicly documented attack of its kind: a flood of traffic measuring 7.3 Tbps aimed at a single customer IP. The attack came barely three weeks after Cloudflare's Q1 2025 DDoS threat report had flagged attacks reaching 6.5 Tbps and 4.8 billion packets per second (pps) — figures that at the time were themselves records.
The 7.3 Tbps volume is 12% larger than Cloudflare's previous high-water mark and roughly 1 Tbps above a 6.3 Tbps attack reported independently by KrebsOnSecurity in May 2025.
A fast, massive, and unusually broad payload
The target was a hosting provider using Cloudflare's Magic Transit service to protect its IP network. Hosting providers have increasingly become the focus of large-scale DDoS campaigns; Cloudflare's threat report noted that 13.5 million DDoS attacks were blasted at its own infrastructure and its hosting-provider customers during January and February 2025.
How much data is 7.3 Tbps, exactly? Left uninterrupted, the attack would have delivered 37.4 terabytes to the victim in just 45 seconds — not a number that sounds staggering in an era of exabyte-scale storage, but one that becomes remarkable when compressed into well under a minute. In more human terms, that's the equivalent of 9,350 full-length HD movies, or 7,480 hours of nonstop high-definition video, or 12.5 million high-resolution photos, all hitting a single network in three-quarters of a minute.
The traffic was distributed widely: it landed on an average of 21,925 destination ports per second on a single IP address owned by the victim, peaking at 34,517 destination ports in any given second. The attack originated from a similarly broad spread of source ports.
Overwhelmingly UDP, with a small long tail of reflection techniques
Around 99.996% of the attack traffic consisted of UDP floods. The remaining fraction — roughly 1.3 GB of the total — came from a mix of reflection and amplification vectors: Quote of the Day (QOTD), Echo, NTP reflection, Mirai-style UDP floods, Portmap floods, and RIPv1 amplification.
The seven vector types raise different mitigation questions:
- UDP floods attempt to saturate the target's Internet link or overwhelm in-line appliances. Cloudflare recommends cloud-based volumetric protection, smart rate-limiting, and dropping unwanted UDP outright — but notes that aggressive rules risk breaking legitimate UDP services such as VoIP, video conferencing, and online games.
- QOTD (UDP port 17) is a reflection vector that abuses the obsolete Quote of the Day protocol. Since the service is a diagnostic leftover, blocking UDP/17 and disabling the service is safe.
- Echo (UDP/TCP port 7) works similarly: the protocol simply replies with whatever it receives, making it a convenient reflector. It too is obsolete, so disabling it has no side effects.
- NTP (UDP/123) attackers exploit the
monlistcommand, found on older NTP servers, which replies to a small request with a large list of recent connections. This one deserves nuance: blocking UDP/123 to external sources is fine, but over-broad filtering can disrupt legitimate time synchronization. - Mirai-style floods come from botnets of compromised IoT devices hammering targets with service-specific or random UDP payloads. Defending requires rate-limiting rules that account for the legitimate UDP endpoints on the network, such as voice and VPN traffic.
- Portmap (UDP/111), part of the RPC service-discovery stack, can be a reflection source. It can be disabled unless applications such as NFS depend on it.
- RIPv1 (UDP/520) is an unauthenticated, legacy routing protocol. Blocking inbound UDP/520 is usually safe, though organizations should check for any legacy routing dependencies.
Origins: Brazil and Vietnam dominate
The attack fleet was enormous: 122,145 source IPs spread across 5,433 autonomous systems (ASes) in 161 countries. The average number of unique source IPs per second was 26,855, peaking at 45,097.
About a quarter of the traffic came from Brazil and a quarter from Vietnam. Taiwan, China, Indonesia, Ukraine, Ecuador, Thailand, the United States, and Saudi Arabia together contributed roughly another third, per Cloudflare's analysis of source addresses.
At the network level, Telefonica Brazil (AS27699) was the single largest source, pumping 10.5% of the attack traffic. Viettel Group (AS7552) was close behind at 9.8%. China Unicom (AS4837) and Chunghwa Telecom (AS3462) contributed 3.9% and 2.9% respectively, and China Telecom (AS4134) 2.8%. Claro NXT (AS28573), VNPT Corp (AS45899), UFINET Panama (AS52468), STC (AS25019), and FPT Telecom (AS18403) each delivered between 1.3% and 1.8% of the total.
Helping providers find the offenders
Cloudflare also points to a mitigation after the fact: a free DDoS Botnet Threat Feed aimed at service providers. The feed lists IP addresses within a provider's own ASN that Cloudflare observes launching HTTP DDoS attacks. More than 600 organizations worldwide have signed up. Access does not require a paid account: it takes a free Cloudflare account, ASN authentication via PeeringDB, and then pulling the report over an API.
Blocking at the edge: How Cloudflare stopped the 7.3 Tbps attack
Spreading the load with anycast
The targeted IP was advertised globally via anycast, which routed incoming attack packets to the nearest Cloudflare data center. This distributed approach worked in defenders' favor: mitigation happened close to the botnet nodes while legitimate users continued to be served from the data centers closest to them. The attack was detected and mitigated across 477 data centers in 293 locations worldwide, with high-traffic areas containing multiple data centers.
Autonomous detection and fingerprinting
Because every service runs in every data center, detection and mitigation are fully autonomous and can occur regardless of attack origin. When a packet arrives, it is load-balanced to an available server, where samples are pulled from deep within the Linux kernel via the eXpress Data Path (XDP) using an extended Berkeley Packet Filter (eBPF) program. These samples move to user space for analysis by the heuristic engine dosd (denial of service daemon), which scans for suspicious patterns such as commonalities in packet header fields and other packet anomalies.
For customers, this complex system is exposed as the DDoS Protection Managed Rulesets—a group of user-friendly managed rules. When dosd detects patterns, it generates multiple fingerprint permutations to find the most accurate match, aiming for surgical precision against attack traffic without touching legitimate traffic.
From fingerprint to mitigation
Packet samples matching each fingerprint permutation are counted using a data streaming algorithm, which surfaces the fingerprint with the most hits. Once activation thresholds are exceeded—a guard against false positives—a mitigation rule compiles as an eBPF program that drops matching packets. The rule times out and is automatically removed once the attack subsides.
Threat intelligence sharing
Each server operates independently, detecting and mitigating attacks on its own, but it also gossips—or multicasts—the top fingerprint permutations within its data center and globally. This real-time threat intelligence sharing improves mitigation efficacy both locally and across the entire network.
Autonomous defense in action
The record-breaking 7.3 Tbps attack was blocked fully autonomously. No human intervention, no alerts triggered, no incidents caused. The system's effectiveness underscores Cloudflare's mission of providing free unmetered DDoS protection in service of a better Internet.
