CloudFlare Thwarts Record DDoS Attack Peaking at 15 Million Requests Per Second

Cloudflare on Wednesday disclosed that it acted to mitigate a
15.3 million request-per-second (RPS) distributed denial-of-service
(DDoS) attack. The web infrastructure and website security company
called it one of the “largest HTTPS DDoS attacks on record.”

“HTTPS DDoS attacks are more expensive in terms of required
computational resources because of the higher cost of establishing
a secure TLS encrypted connection,” Cloudflare’s Omer Yoachimik and
Julien Desgats said^[1]. “Therefore it costs the
attacker more to launch the attack, and for the victim to mitigate
it.”

The volumetric DDoS attack is said to have lasted less than 15
seconds and targeted an unnamed Cloudflare customer operating a
crypto launchpad.

Volumetric DDoS attacks are designed to overwhelm a target
network/service with significantly high volumes of malicious
traffic, which typically originate from a botnet under a threat
actor’s control.

Cloudflare said the latest attack was launched from a botnet
comprising roughly 6,000 unique compromised devices, with 15% of
the attack traffic originating from Indonesia, followed by Russia,
Brazil, India, Colombia, and the U.S.

“What’s interesting is that the attack mostly came from data
centers,” Yoachimik and Desgats noted. “We’re seeing a big move
from residential network Internet Service Providers (ISPs) to cloud
compute ISPs.”

Record-setting DDoS attacks have become increasingly common in
recent months. In August 2021, Cloudflare disclosed^[2]
what it characterized as the largest application-layer attack ever
seen, and, earlier this year, Microsoft revealed^[3]
that it had prevented multiple DDoS attacks that crossed 2.4
terabits per second (Tbps).