Cloudflare successfully defended against the largest distributed denial-of-service (DDoS) attack ever recorded, reaching a peak of 7.3 terabits per second (Tbps) in mid-May 2025. The attack targeted an unnamed hosting provider and delivered 37.4 terabytes of malicious traffic in just 45 seconds.
## Escalating Attack Patterns
This record-breaking incident represents a significant escalation in DDoS attack intensity. Earlier in 2025, Cloudflare mitigated a 5.6 Tbps attack against an Eastern Asian internet service provider, originating from a Mirai-variant botnet. In April, the company blocked a 6.5 Tbps attack lasting 49 seconds, likely from the Eleven11bot network comprising approximately 30,000 compromised webcams and video recorders.
## Attack Characteristics
The 7.3 Tbps assault demonstrated sophisticated multi-vector tactics, targeting an average of 21,925 destination ports on a single IP address, with peaks reaching 34,517 ports per second. The attack combined multiple techniques including UDP floods (99.996% of traffic), QOTD reflection attacks, echo reflection attacks, NTP reflection attacks, and various amplification methods.
## Global Attack Infrastructure
The attack originated from over 122,145 source IP addresses across 5,433 Autonomous Systems spanning 161 countries. Brazil, Vietnam, Taiwan, China, and Indonesia were the primary sources of malicious traffic. Telefonica Brazil contributed the largest portion at 10.5%, followed by Viettel Group at 9.8%.
## RapperBot Threat Emerges
Security researchers have identified RapperBot, a DDoS botnet active since 2022, as responsible for attacks against AI company DeepSeek in February 2025. The botnet now demands “protection fees” from potential victims to avoid future attacks.
RapperBot targets routers, network storage devices, and video recorders with weak passwords or firmware vulnerabilities. The malware uses custom encryption for command-and-control communications and has shown increased activity since March 2025, averaging over 100 attack targets daily with more than 50,000 active bots.
## Industry Impact
These attacks highlight the growing threat to hosting providers and critical internet infrastructure. The sophistication and scale of modern DDoS attacks demonstrate the need for robust cybersecurity measures across all sectors, from public services to financial institutions.