Cloudflare has revealed that it blocked the largest Distributed Denial-of-Service (DDoS) attack ever recorded in mid-May 2025. The attack peaked at 7.3 terabits per second (Tbps), surpassing previously recorded threats.

This news follows the company’s Q1 2025 DDoS threat report, released on April 27, which highlighted major attacks reaching 6.5 Tbps and 4.8 billion packets per second (pps).

The target was a hosting provider using Cloudflare’s Magic Transit service to protect its IP network. Attacks on hosting and infrastructure providers are reportedly increasing, according to Cloudflare’s threat report.

The 7.3 Tbps attack transferred 37.4 terabytes of data in just 45 seconds. This is equivalent to:

• Streaming 7,480 hours of HD video nonstop
• Downloading 9.35 million songs in under a minute

Cloudflare’s systems detected and blocked the attack automatically, ensuring zero service disruption.

The attack used a newly emerging method exploiting HTTP/2, a common web protocol. At its peak, it delivered over 200 million requests per second, aiming to overwhelm robust infrastructure.

Cloudflare reported that the attack:

• Targeted an average of 21,925 ports on a single IP address
• Peaked at 34,517 destination ports per second
• Originated from over 122,145 source IPs across 5,433 autonomous systems in 161 countries

About 50% of the traffic came from Brazil and Vietnam. Other sources included Taiwan, China, Indonesia, Ukraine, Ecuador, Thailand, the U.S., and Saudi Arabia.

The multivector attack was mostly composed of UDP floods, with smaller volumes of QOTD reflection, Echo, NTP, Mirai, Portmap, and RIPv1 amplification attacks.

To help providers respond to such threats, Cloudflare offers a free DDoS Botnet Threat Feed. Over 600 global organizations have subscribed to this API-based feed to identify abusive IPs within their networks.

Cloudflare confirmed that its DDoS protection systems neutralized the threat without human intervention, alerts, or incidents. The company emphasized its commitment to building a safer Internet and providing free, unmetered DDoS protection.

Cloudflare’s global network spans over 300 cities in more than 100 countries. Its automated systems are designed to respond quickly and effectively to evolving cyber threats.

Related post

View all