Record in DDoS Attack 7.3 Terabits per Second: The Largest Recorded DDoS Attack to Date

Related Vendors

Cloudflare GmbH

FAULHABER Drive Systems

dataTec AG

Wuxi InfiMotion Technology Co., Ltd.

The globally operating internet infrastructure service provider Cloudflare recorded the largest DDoS attack to date on a customer, a hosting provider, in mid-May 2025, according to its own information. A total of 37.4 terabytes of data were fired in just 45 seconds.

DDoS attacks are becoming popular again. In the first quarter of 2025, Internet infrastructure provider Cloudflare reported 20.5 million DDoS attacks, which represents a 358 percent increase compared to the same period last year. Cloudflare is an international service provider whose services act as a reverse proxy between the user and the website. This allows the provider's solutions to cache, filter, block, and protect content without the website operator having to build their own servers or security solutions. Other providers like Akamai or AWS Shield are also well-known to most internet users.

A DDoS (Distributed Denial of Service) is a common method of cybercrime, where systems are crippled by massive amounts of requests. This often happens via a large network of hacked computers (known as a botnet). The server becomes so overwhelmed that it can no longer respond to genuine users. A DDoS is like a traffic jam on the data highway – only intentionally caused.

Gallery

Gallery with 9 images

What dimensions DDoS attacks can reach is shown in a report by Cloudflare dated June 19, 2025. Within 45 seconds, an incredible 37.4 terabytes of junk data were fired at the servers of a hosting provider, a client of Cloudflare – equivalent to 7.3 terabits per second (Tbps). Previously, the largest recorded DDoS attacks by Cloudflare reached 6.5 Tbps and 4.8 billion packets of data sent per second. The attack recorded in May 2025 surpassed the previous "peak" by around twelve percent.

The Volume of Data is Not a Record, but the Speed Certainly Is

"37.4 terabytes by today's standards aren't an overwhelming number, but blowing through 37.4 terabytes in just 45 seconds is," the folks at Cloudflare note. If you cannot imagine these amounts of data, don't worry because Cloudflare provides a few fitting examples for comparison: "It's equivalent to flooding your network with over 9,350 full-length HD movies or streaming 7,480 hours of high-definition videos without interruption (that's almost a year of continuous binge-watching) in just 45 seconds. If it were music, you would download about 9.35 million songs in less than a minute – enough to occupy a listener continuously for 57 years. Imagine if you could snap 12.5 million high-resolution photos on your smartphone and never run out of storage space – even if you took a photo every day, you would have to click for 4,000 years – but in 45 seconds."

A single server was targeted and overwhelmed with a massive DDoS attack. Over 20,000 different ports were attacked simultaneously per second, at peaks even over 34,000. Such widespread attacks (also known as "carpet bombing") aim to cripple not just one service but all possible entry points of a server simultaneously. Additionally, tens of thousands of different source ports were used, complicating the detection and filtering of the attack. The best protection against such an attack is a combination of cloud services, network security, and properly configured infrastructure.

Attack of the Zombie Computers

The described DDoS attack originated from over 122,000 IP addresses distributed across 5,433 autonomous networks in 161 countries. Notably, almost half of the traffic came from Brazil and Vietnam. Other significant contributions came from Taiwan, China, Indonesia, Ukraine, Ecuador, Thailand, the USA, and Saudi Arabia. On average, over 26,000 different IPs were active per second, with peaks exceeding 45,000.

This global distribution is a typical indication of a botnet, a network of infected devices that execute attacks remotely as so-called zombie computers. Such devices can be PCs, routers, or IoT components like smart TVs or cameras. They continue to operate unnoticed in the background while sending automated requests to the attack target.

The multitude of countries and networks makes it difficult to filter such attacks, as the traffic often appears like regular user access. Cybersecurity is therefore increasingly becoming mandatory even for smaller, connected devices. More details about the attack can be found on Cloudflare's blog. (sb)