DDoS attacks on websites,
measured.

What is a DDoS attack on a website?

The canonical modern example is the Mirai botnet. In 2016, Mirai infected hundreds of thousands of insecure IoT devices (IP cameras, home routers) by trying a short list of factory-default passwords. The resulting botnet was used for the attack on the blog of journalist Brian Krebs (620 Gbps, September 2016), against hosting provider OVH (about 1 Tbps, September 2016), and, most consequentially, against DNS provider Dyn on October 21, 2016, which knocked Twitter, Netflix, Spotify, Reddit, and PayPal offline for hours. Mirai's source code was published shortly after, and its descendants still drive a large share of attacks today, including the 5.6 Tbps record attack mitigated by Cloudflare in 2024, attributed to a Mirai-variant botnet.

Why websites are the primary target

Websites concentrate three things that motivate attackers: money (extortion campaigns demanding ransom to stop an attack), competition (attacks timed to sales events), and visibility (hacktivist campaigns against media and government sites). Because a public website must, by design, accept connections from anyone, it cannot simply close the door. Defense requires distinguishing malicious traffic from legitimate traffic at massive scale, which is the entire engineering problem of DDoS mitigation.

Attack taxonomy: three layers of DDoS

Every DDoS attack on a website belongs to one of three classes, defined by which resource it exhausts. This taxonomy is used consistently by NETSCOUT, Cloudflare, and CISA:

Amplification: how small requests become terabit floods

Volumetric records are set almost exclusively through reflection/amplification. The attacker sends small spoofed requests to open services (DNS resolvers, NTP servers, memcached instances) with the victim's address forged as the source; the services then fire much larger responses at the victim. Memcached amplification, the vector behind the 2018 GitHub record, can multiply traffic by a factor of up to roughly 51,000, the highest publicly documented amplification factor.

HTTP/2 Rapid Reset: the newest record-setting technique

In 2023, attackers abused a design feature of the HTTP/2 protocol (CVE-2023-44487): opening a stream and immediately cancelling it forces the server to do allocation work while consuming almost no attacker resources. Google disclosed a peak of 398 million requests per second, more than the entire Wikipedia receives in a month, compressed into two minutes. The disclosure triggered coordinated patching across Cloudflare, AWS, Google, and the wider industry, and remains the reference example of how a protocol-level flaw changes the economics of Layer 7 attacks.

Timeline: the largest DDoS attacks on record

The table below aggregates only publicly disclosed, attributable incidents confirmed by the organizations that mitigated them. It is the backbone of our longitudinal analysis.

Our computed analysis: how fast is attack capacity growing?

Using only the disclosed record values above, peak volumetric attack capacity grew from about 1 Tbps (2016) to 5.6 Tbps (2024): a compound annual growth rate of roughly 24% per year over eight years. In parallel, the request-rate frontier made a discontinuous jump with HTTP/2 Rapid Reset: 398M rps against targets that previously considered 10M rps an extreme event. The practical consequence: on-premises mitigation hardware sized for yesterday's record is structurally insufficient, which is why the market has consolidated around Anycast-scrubbing providers with aggregate network capacity measured in hundreds of Tbps.

DDoS statistics: volume, frequency, targets

• Volume. Cloudflare reports mitigating 20.5 million DDoS attacks in 2024, up from roughly 14 million in 2023, approximately a 50% year-over-year increase (Cloudflare DDoS Threat Report, Q1 2025).
• Frequency. NETSCOUT's ATLAS sensor infrastructure, which observes a large share of global backbone traffic, counted about 8 million attacks in the first half of 2023 alone, and has tracked continued growth since.
• Duration profile. The vast majority of attacks are short, under one hour. This aligns with the economics of booter/stresser services that historically sold attack time in minutes; extortion campaigns, however, combine short demonstration attacks with threats of sustained campaigns.
• Target distribution. The most attacked verticals consistently include gaming, financial services, telecommunications/hosting, e-commerce, and, since 2022, government and media websites in geopolitically active regions.
• IoT growth. The pool of botnet-eligible devices keeps expanding. Analyses of Mirai descendants show exploitation moving far beyond the original default-password scanning into dozens of unpatched router and camera vulnerabilities.

What a DDoS attack costs a website owner

Cost estimates vary by methodology, but independent sources converge on an uncomfortable range:

• Gartner (2014) benchmarked average IT downtime at $5,600 per minute (about $300,000 per hour). Later Uptime Institute surveys show the distribution shifting upward, with a majority of significant outages exceeding $100,000 and a substantial minority exceeding $1 million.
• For e-commerce, the cost is measurable directly in lost transactions: an outage during a peak sales day converts peak revenue into zero, plus ad spend burned on clicks that land on a dead site.
• Long-tail costs include SLA penalties to B2B customers, search-ranking damage from prolonged downtime, customer churn, and incident-response labor.
• Historically documented cases underline the extremes: the 2016 Dyn outage disrupted revenue for dozens of major platforms simultaneously, and Russian national railway carrier RZD publicly reported multi-million-rouble losses from an attack on its ticketing website (2014), one of the few cases with officially disclosed damages.

How to protect a website from DDoS

Government and industry guidance (CISA ST04-015, ENISA, and the major mitigation providers) converges on a layered defense model:

1. Absorb volumetric attacks upstream

No amount of on-site configuration stops a multi-terabit flood from saturating your last-mile link. Volumetric attacks must be absorbed before they reach you, by an Anycast-based CDN or scrubbing provider (Cloudflare, Akamai Prolexic, AWS Shield, Google Cloud Armor, Fastly) whose aggregate network capacity exceeds attack volume by orders of magnitude.

2. Filter Layer 7 attacks at the application edge

HTTP floods require a Web Application Firewall (WAF) with rate limiting, JavaScript/bot challenges, and behavioural analysis. Rules should distinguish humans from botnet clients, cap requests per IP or session, and cache aggressively so that expensive dynamic pages are served from the edge.

3. Harden the infrastructure baseline

• Redundant, DDoS-resilient DNS (the Dyn incident showed DNS is a single point of failure for entire companies).
• Over-provisioned bandwidth and load balancing with connection-state limits.
• Rate limiting on authentication, search, and API endpoints, the classic L7 magnifiers.
• Disabling unused UDP services and ensuring your own servers are not usable as open amplifiers (see CISA and Shadowserver open-resolver data).

4. Prepare the response, not just the wall

CISA's core recommendation is procedural: an incident plan with upstream-provider contacts, pre-arranged mitigation contracts, and communication templates. Organizations that improvise their defense during an attack lose the most expensive hours first.

The legal context: attacks, booters, and enforcement

Understanding the legal landscape matters for this research because it shapes where attack infrastructure comes from. DDoS attacks are crimes under the US Computer Fraud and Abuse Act (18 U.S.C. § 1030), the UK Computer Misuse Act 1990, and EU Directive 2013/40/EU. The attack-for-hire market, known as booters and stressers, has been a sustained law-enforcement target: Europol's Operation PowerOFF (2018 to present) has seized dozens of booter domains and led to arrests of administrators and customers across multiple countries, while the US Department of Justice has prosecuted booter operators in several high-profile cases. This enforcement pressure is one reason the attack market has migrated toward raw botnet rentals rather than public web storefronts.

Frequently asked questions

Methodology and sources

This report aggregates and independently analyzes exclusively public, attributable sources. Where we derive new numbers (growth rates, comparison indices), the inputs and computations are stated next to the claim. Primary sources:

• Cloudflare DDoS Threat Reports (quarterly, 2023 to 2025): attack volume, record 5.6 Tbps incident
• Google Cloud / Google Security Blog: 2.54 Tbps disclosure (2020), HTTP/2 Rapid Reset 398M rps (2023)
• AWS Shield: 2.3 Tbps disclosure (AWS Security Blog, 2020)
• GitHub Engineering Blog and Akamai: 1.35 Tbps memcached incident (2018)
• NETSCOUT ATLAS / Threat Intelligence Reports: global attack counts
• KrebsOnSecurity, OVH, Dyn incident retrospectives (2016): Mirai botnet campaign
• CISA ST04-015 "Understanding Denial-of-Service Attacks"; ENISA threat landscape reports
• Europol press releases on Operation PowerOFF; US DOJ booter-service prosecutions
• Gartner downtime cost benchmark (2014); Uptime Institute Annual Outage Analysis

Corrections: if a figure above is outdated or misattributed, contact the editorial team via the site. Verifiable corrections are published with attribution.