Cloudflare reports on the greatest DDOS attack of all time – a whopping 37.4 TB was thrown onto a target within 45 seconds. (© Cloudflare)
The term cloud flare is likely to have been accommodated by most of you: the American company specializes in the defense against DDOS attacks (Distributed Denial of Service); If the service is active, some websites can happen that you will be checked for your trustworthiness, so to speak.
As the company now reveals in a blog entry, Cloudflare successfully repelled such a DDOS attack-it is the Greatest DDOS attack ever documented.
The record attack in detail
Table of Contents
According to Cloudflare, this previously DDOS attack took place in mid-May 2025 and achieved a top output of 7.3 terabits per second; The previous record was exceeded by twelve percent.
- Within only 45 seconds, 37.4 terabytes of malignant data traffic were aimed at a hosting provider.
- This amount of data not only corresponds to over 9,350 HD films, but also 7,480 hours of high-resolution video streaming or about 9.35 million pieces of music. Incidentally, Cloudflare itself chose the comparison values – we do not know how many soccer fields are.
The The aim of the attack was a hosting providerthe Cloudflares “Magic Transit” service used to defend his IP network. According to the company, this choice did not happen by chance: hosting providers and critical internet infrastructures are increasingly becoming preferred destinations of DDOS attacks because they are Multipliers for disorders can act.
A “area bombing” as an attack vector
The attack was a so-called “Carpet Bombing” attack that was average 21,925 target ports per second covered and reached top values of up to 34,517 ports per second. This technique simply aims to overload firewall and attack detection systems by spreading data traffic.
The attack was interpreted multivectorial: 99.996 percent of data traffic passed out UDP-Floodswhile the remaining 0.004 percent were divided into various reflection and amplification attacks.
UDP flood attack explained
A “UDP-Flood«True to the designation of a server with an unusually large amount of UDP packages.
A popular illustration of the attack is the hotel receptionist who is analogous to the server: Usually he takes calls (the UDP packages), checks whether the guest is available in the room, and connects the call-or tells the caller that nobody answers. With a UDP flood, the following happens:
- Suddenly all phones ring at the same time, in which the attackers all ask about (non -existent guests).
- The receptionist must check the list of rooms with every call and tell the caller that the guest is not available – in thousands of parallels, he is simply overloaded at some point.
- As a result, legitimate callers no longer get through to the receptionist because he is under the counter.
Global distribution shows striking pattern
The attack came from More than 122,145 source IP addresses From 5,433 autonomous systems in 161 countries.
- The geographical concentration is particularly striking: almost half of the traffic traffic came from Brazil and Vietnam, each of which made up around 25 percent of the total volume.
- Other important sources were Taiwan and China with eight percent each, followed by Indonesia with six percent.
The distribution shows a clear pattern for Cloudflare: the largest shares come from regions with high internet penetration, but possibly insufficiently protected IoT devices and servers.
Anycast to cushion, EBPF for real -time filters
In the associated message, Cloudflare also proudly explains how the attack was blocked. The global »Anycast« network was used to attack the attack to distribute on 477 data centers in 293 locations worldwide.
This distribution uses the nature of DDOS attacks to a certain extent against it. The heart of the defense forms autonomous detection and defense systembased on EBPF technology (Extended Berkeley Packet Filter).
- This system analyzes package samples directly from the Linux kernel and identifies suspicious patterns using a proprietary Heuristik-Engine called »dosd«.
- As soon as attack patterns are recognized, The system automatically compiles filter rules as EBPF programsblock the harmful packages in real time.
