Record 11.5 Tbps: Cloudflare Blocks the Most Powerful DDoS Attack in History
The story of the 11.5 terabit tsunami.
The story of the 11.5 terabit tsunami.
Cloudflare has reported blocking the largest volumetric DDoS attack ever recorded, with a peak power of 11.5 terabits per second (Tbps). In such attacks, malicious actors overwhelm a target with colossal amounts of data, clogging communication channels or exhausting system resources to the point where legitimate users lose access to services and servers.
According to the company, its protection systems have been operating at their limit in recent weeks: hundreds of hyper-volumetric attacks have been automatically mitigated, including peaks of 5.1 billion packets per second and 11.5 Tbps. Initially, the report stated that the most powerful attack lasted about 35 seconds and originated primarily from Google Cloud infrastructure; however, this claim was later corrected. In reality, the traffic came from various sources: botnets based on IoT devices and cloud providers. Google Cloud representatives separately emphasized that their protection worked as intended and that the information about their traffic dominating the attack does not correspond to reality.
This episode set a new record just two months after the previous one: in June, Cloudflare neutralized a 7.3 Tbps attack against an unnamed hosting provider. The record set in October 2024 was 3.8 Tbps and 2 billion packets per second. Microsoft has also faced comparable threats: in January 2022, its infrastructure repelled a 3.47 Tbps attack targeting an Azure customer in Asia, and in July 2024, another campaign disrupted the operation of a number of Microsoft 365 and Azure services worldwide.
In April, Cloudflare published a quarterly report noting a sharp increase in DDoS activity. According to its data, in 2024, the number of attacks increased by 198% compared to the previous quarter and by 358% year-over-year. In total, over the year, 21.3 million attacks were recorded against its customers, and another 6.6 million against the company's own infrastructure as part of an 18-day, multi-layered campaign. A wide variety of techniques were used: SYN-floods, Mirai botnet attacks, amplified requests via SSDP, and others.
The growth in network-layer attacks is particularly noticeable. These attacks showed the maximum surge at the beginning of 2025, increasing by 509% compared to the same period last year. The new record of 11.5 Tbps demonstrates that the scale of DDoS threats continues to grow rapidly, and neutralizing them requires increasingly large-scale and automated protection systems.
