Cloudflare Thwarts Largest-Ever DDoS Attack at 11.5 Tbps
The internet infrastructure giant's automated defenses blocked a record-breaking assault in late August 2025.
What Happened
Cloudflare, one of the world’s biggest internet infrastructure and security firms, has once again made headlines by stopping the largest distributed denial-of-service (DDoS) attack ever recorded. The attack, which peaked at an astonishing 11.5 terabits per second (Tbps) and reached 5.1 billion packets per second (Bpps), struck in late August 2025. The company disclosed the incident on September 3, confirming that its automated defenses successfully blocked the massive traffic surge in real time.
A DDoS attack is when hackers flood a network or website with fake traffic, overwhelming servers so that legitimate users cannot access the service. In this case, the attackers unleashed a storm of junk data at such a scale that most organizations would have been instantly knocked offline.
To put this in perspective, the average broadband home connection handles around 100 Mbps. This attack was 10,000 times bigger, all focused on a single target at once.
Source of the Attack
At first, Cloudflare noticed much of the traffic appeared to come from Google Cloud servers. However, after closer analysis, the company clarified that the traffic was multi-sourced:
- Compromised IoT devices – such as hacked security cameras, smart routers, and connected appliances.
- Cloud infrastructure – attackers abused computing power from multiple cloud service providers.
- Botnet coordination – likely a new or updated malware variant that enslaved thousands of devices worldwide.
This combination of IoT devices plus cloud servers shows how attackers are mixing traditional botnets with high-bandwidth cloud systems to create hyper-volumetric DDoS attacks.
Cloudflare’s Response
The most impressive part of the story is how Cloudflare stopped the attack automatically:
- Its AI-driven DDoS mitigation systems detected the flood instantly.
- Filters blocked the malicious packets within seconds.
- The target website or service stayed online the entire time.
- No human intervention was required—Cloudflare’s infrastructure absorbed the attack, analyzed the sources, and dropped the harmful traffic without disrupting legitimate users.
Why It Matters
The event shows that traditional firewalls or small-scale protections are useless at this scale. This record-breaking attack highlights several critical trends, including the rapid scaling of attack capabilities, the persistent vulnerability of IoT devices, and the exploitation of cloud resources by malicious actors.
Possible Motives
Why launch an attack so massive for just 35 seconds? Experts see a few possibilities:
- Testing new botnets – Hackers may have been measuring how strong their new system is.
- Extortion attempt – Sometimes attackers fire a short “demo attack” to scare victims into paying ransom.
- State-level probing – Nation-state hackers may be testing global defenses without revealing their true targets.
Regardless of motive, the sheer size is a warning shot for the future.
Implications for the Internet
DDoS attacks remain one of the easiest and most effective weapons for cybercriminals, hacktivists, and even governments. This incident underscores the increasing frequency of hyper-volumetric attacks and the stress they place on global internet infrastructure. It's a clear signal that every organization relying on uptime must prioritize robust, automated defense strategies.
Final Thoughts
The 11.5 Tbps DDoS attack was not just a record-breaking assault—it was a glimpse into the future of cyberwarfare. Attackers are moving faster, using bigger botnets, and abusing more powerful infrastructure than ever before.
The fact that Cloudflare stopped the attack so quickly is reassuring, but it also highlights the arms race between attackers and defenders. For every defensive upgrade, hackers look for more insecure devices, more bandwidth, and new techniques to overwhelm systems. For everyday internet users, the fight is mostly invisible—but every time you stream a video, shop online, or log in to your bank, it’s thanks to unseen battles like this one that the web stays online.
