Massive DDoS Blitz Shatters Records with 2.4 Billion Requests in Five Hours

A landmark cybersecurity investigation has uncovered a remarkably fragmented Distributed Denial of Service operation that recently targeted a major user-generated content platform.

Research conducted by the Galileo threat intelligence unit at DataDome reveals that over a mere five-hour window in mid-April, attackers unleashed a staggering 2.45 billion malicious requests. Unlike traditional high-volume assaults that attempt to overwhelm systems through sheer brute force, this campaign utilized a sophisticated low and slow methodology that allowed it to bypass conventional security protocols. While the attack reached a peak intensity of 205,344 requests per second, its distributed nature ensured it remained invisible to standard rate-limiting defenses.

The infrastructure behind the assault was characterized by unprecedented dispersion, leveraging more than 1.2 million distinct IP addresses across 16,402 separate Autonomous Systems. To put this in perspective, typical large-scale data scraping efforts usually involve only a few hundred networks. The traffic was spread so thinly that no single network contributed more than 3% of the total volume, making simple IP-based blocking strategies virtually ineffective. High-traffic providers like Cloudflare, DigitalOcean, and Google were mixed with privacy-centric networks to further mask the malicious flood within legitimate internet traffic.

This was clearly a managed operation, potentially guided by human intervention or advanced orchestration layers that adjusted the campaign based on real-time detection signals. The botnet followed a pulsed cadence, with individual IP addresses sending requests approximately every nine seconds to stay safely beneath detection thresholds. Despite the attackers' efforts to mimic authentic browsers by forging cookies and TLS fingerprints, the campaign was ultimately identified through behavioral analysis. Experts observed inconsistencies in TLS handshakes and unstable identification signals that real users do not generate. Analysts conclude that modern security must shift toward long-term behavioral modeling, as static volume limits are no longer sufficient to stop highly fragmented, modulated attacks.