Attack exploited HTTP/2 vulnerability to deliver 37.4 TB of traffic—neutralized with zero disruption, zero alerts, and full automation
In a stunning demonstration of scale and resilience, Cloudflare has confirmed it successfully mitigated the largest DDoS attack ever recorded, peaking at an unprecedented 7.3 terabits per second (Tbps). The attack, which took place in mid-May 2025, targeted a Cloudflare customer—a major hosting provider—via Cloudflare’s Magic Transit service.
The attack was over in just 45 seconds, but in that time it delivered 37.4 terabytes of malicious traffic, equivalent to 9,350 HD movies or 57 years of nonstop music downloads. Despite its sheer scale and speed, Cloudflare’s autonomous DDoS protection systems neutralized the attack with no downtime, no manual intervention, and no service interruption.
This attack represents a new wave of ultra-fast, high-volume cyber assaults, with the attacker launching more than 200 million HTTP/2 requests per second, exploiting a protocol vulnerability to amplify the threat. Over 122,000 source IPs across 161 countries were involved—many originating from Brazil and Vietnam, with traffic also coming from China, Indonesia, Ukraine, and Saudi Arabia.
Categorized as a multi-vector attack, it was composed mostly of UDP floods, with traces of advanced reflection techniques including Mirai, QOTD, and NTP reflection attacks. The malicious data bombarded over 21,000 destination ports per second—a digital blitzkrieg designed to bring infrastructure to its knees.
Cloudflare responded by offering free access to its Botnet Threat Feed, enabling over 600 service providers worldwide to proactively shut down abusive nodes before damage is done.
The incident is a stark reminder of the escalating DDoS landscape—but also proof that with the right infrastructure, the internet can defend itself.
