A volunteer fire map becomes a DDoS target
On July 31, 2025, as Portugal entered the peak of its wildfire season, an automated alert from Cloudflare notified João Pina, also known as Tomahock, that his volunteer-run project fogos.pt was under attack. What began in 2015 as a late-night side project with friends in Aveiro has grown into a critical public resource: the site that firefighters, journalists, citizens, and government agencies consult to understand what is happening on the ground during wildfires.
Fogos.pt started with a simple question: why was fire data only available in hard-to-read PDF documents? Pina and a group of friends, including volunteer firefighters, pulled the data, geolocated the fire reports, and visualized them on a map. Thousands began using it, then tens of thousands. Today the site is integrated into official communications, including mentions from the Portuguese government and direct links from the national wildfire information portal, SGIFR.gov.pt.
In 2018, fogos.pt formally joined forces with VOST Portugal, a digital volunteer organization also protected under Project Galileo, Cloudflare's initiative to safeguard vulnerable public interest sites at no cost. Pina, a co-founder of VOSTPT, helped create a complementary model: fogos.pt provides data and the platform; VOSTPT validates and communicates it in real time during emergencies. The entire operation runs without funding or a formal team.
Two attacks during peak fire season
On July 31 and August 1, 2025, two Distributed Denial of Service (DDoS) attacks targeted fogos.pt. Cloudflare automatically detected and mitigated both.
- July 31 attack: 7 minutes duration, peak of 33,000 requests per second at 11:27 UTC, maximum bandwidth of 1.7 Gbps.
- August 1 attack: 5 minutes duration, peak of 31,000 requests per second at 10:24 UTC, maximum bandwidth of 849 Mbps.
By Cloudflare's standards these were small—the company recently mitigated an attack exceeding 700,000 requests per second against a high-profile US election campaign site. But for a civic project like fogos.pt, even tens of thousands of requests per second can take services offline at the worst possible moment if unprotected.
DDoS attacks typically rely on three main sources: hacked IoT devices sending traffic, open or misconfigured proxies that hide attackers' IPs, and compromised or rented cloud servers. The July 31 attack likely used open proxies, with much of the traffic arriving unencrypted. The August 1 attack came largely from cloud machines, matching patterns from botnets that exploit cloud infrastructure.
Both attacks were blocked without disruption. Cloudflare's autonomous mitigation systems kicked in and emailed alerts were automatically sent to the team. No downtime, no manual intervention.
Surviving traffic surges
Fogos.pt has used Cloudflare's free services since its beginning, starting with DNS and expanding to DDoS mitigation, caching, and rate limiting. The site later joined Project Galileo to receive upgraded features at no cost. The protection matters beyond attacks: traffic surges when wildfires hit the news or get mentioned by authorities. In August 2025, the site often had close to 60,000 people browsing at the same time, with around 40,000 being the norm across web and app services.
"Without Cloudflare, the site would have gone down many times during fire season," says João Pina. "We use almost every product — but protection against attacks is critical."
In just two weeks, with an August 15 peak of almost 70 million requests, fogos.pt handled over 550 million requests (more than 25 million per day), 9 TB of data transfer, nearly 100 million page views, 15 million visits, and 240 million API calls—a massive load for a volunteer-run project.
Wildfires are a global challenge, affecting southern Europe, California, Australia, and Canada, which in 2023 faced record-setting fires. Reliable information can be crucial, sometimes life-saving. Other organizations offering similar public services can apply to join Project Galileo to receive the same protection and handle heavy traffic.
From a dinner-table idea to critical national infrastructure, fogos.pt demonstrates what is possible when public service meets technology—and why the digital infrastructure that keeps people informed deserves protection.
