The largest DDoS attacks ever recorded: the top 10, who ran them, how long they lasted

DDoS records have fallen so fast over the past two years that the numbers have started to lose meaning. The table below ranks the largest publicly disclosed attacks by bandwidth. The interesting part is not the table itself — it is the four observations underneath it.

The top 10 by bandwidth

Two landmarks that sit below the list

Both look small next to today's numbers, and both changed how the internet defends itself.

GitHub — 1.35 Tbit/s, February 2018

There was no botnet. The attacker used misconfigured memcached servers left exposed to the internet: send a tiny query, have the enormous reply delivered to the victim. That is amplificationThe attacker sends a small request and arranges for a much larger response to land on the victim. The source address is forged to look like the victim, so the server in the middle joins the attack without knowing it. With memcached the ratio could reach 50,000x., and it took traffic from zero to 1.35 Tbit/s in under ten minutes. GitHub shut it down in about the same time.

The outcome was permanent: memcached now ships closed to the internet by default, and providers began filtering the port. An entire attack class was patched out of existence.

Dyn — roughly 1.2 Tbit/s, October 2016

IoT cameras conscripted by Mirai went after a DNS provider. When Dyn went down, Twitter, Netflix and PayPal became unreachable across much of the US — none of which were attacked directly.

Four things the table does not show

1. The durations collapsed

The 2020 attack on AWS ran for three days. Every record on this list lasted 35 to 80 seconds. That is a change in strategy, not a coincidence: attackers now aim to overwhelm the target before automated mitigation engages. A short, enormous burst beats sustained moderate pressure, because most systems measure their reaction time in seconds.

2. This list measures transparency, not size

Nearly every row says "mitigated by Cloudflare". Not because they absorb bigger attacks than anyone else — because they publish a quarterly report. Akamai, Google, Azure and the large carriers see comparable events and disclose very few. So the accurate title is not "the ten largest" but "the ten largest we were told about".

3. Largest by which measure?

There are three separate axes and they do not convert into one another: bandwidth (Tbit/s), packet rate (packets per second) and request rate (requests per second). The 29.7 Tbit/s attack was simultaneously 14.1 billion packets per second. Google absorbed 398 million requests per second in 2023 (HTTP/2 Rapid ResetA technique exploiting an HTTP/2 client's ability to open a request and cancel it instantly, then open another. The server begins work on every request while the attacker pays almost none of the cost, producing enormous request rates from very little bandwidth.) — small in bandwidth terms, and more than enough to flatten an application.

In practice what kills a server is usually not terabits but packets. A flood of small packets can fill the operating system's connection table at bandwidth figures that look unremarkable.

4. The attacker's evolution is one straight line

• 2016 — Mirai: hijacked IP cameras and home routers.
• 2018 — memcached: no botnet needed; exposed, misconfigured servers were enough.
• 2020 — CLDAP reflection: protocol abuse multiplying traffic 50–70x.
• 2024 — Mirai variants: 5.6 Tbit/s from only 13,000 devices.
• 2025 — AISURU / Kimwolf: more than two million compromised devices.

AISURU: the current story

The attacks at the top of the list come from the same network. AISURU — also tracked as Kimwolf — is built largely from cheap off-brand Android TV boxes, more than two million of them. These boxes are almost never updated after installation, and their owners have no idea the device is taking part in anything.

In the campaign they launched in December 2025 they went after not just customers but Cloudflare's own dashboard and infrastructure. The hardest-hit sectors: telecoms and carriers, gaming, and generative AI services.

What does this mean for an ordinary site?

The reassuring part: attacks at this scale are aimed at infrastructure providers. An ordinary commercial site being hit with 20 Tbit/s is not something seen in practice — there is no reason for an attacker to spend that kind of capacity on a small target.

The real point is different: nobody needs to break a record to take you down. A few Gbit/s will flatten a single server and the database behind it, and a well-chosen application-layer attack can do it with a few hundred Mbit/s. The numbers above make headlines; the attack that takes your site offline will be far too small to make any.

Then there is duration. The records above are 35-to-80-second bursts, but what actually wears businesses down is moderate pressure sustained for days. That is why the 2020 AWS attack running for three days is still notable. In August 2026, customer addresses behind our own infrastructure took an attack that exceeded 1 Tbit/s and ran for days — nowhere near this list on peak, but exactly that second shape.

For what to do on your side, see the first ten minutes of an attack and how your origin IP leaks.

Protect your site with OZELNS

Authoritative DNS and reverse-proxy DDoS protection in one panel. Free plan available, no card required.