TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

DDoS Mitigation Architecture

38 posts · Jul 2011 – Aug 2026

What this trail covers

Cloudflare's DDoS mitigation architecture has evolved to incorporate an anomaly detection pipeline that builds statistical models to flag unusual traffic patterns. This system uses a multi-dimensional approach, analyzing features beyond just traffic volume, and employs techniques like Principal Component Analysis (PCA) and Mahalanobis distance to create a spherical representation of normal traffic. This allows for global tuning of anomaly detection thresholds, enabling protection against novel and evolving attack vectors. The Q1 2024 report indicates a significant increase in overall DDoS attacks, particularly DNS-based attacks, and highlights new attack vectors like HTTP/2 Continuation Flood, while also noting the continued prevalence of Mirai variants. Cloudflare's advanced defense systems, including the new Advanced DNS Protection system, continue to mitigate millions of attacks.

All Cloudflare trails
  1. Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new waveThis post details the significant increase in hyper-volumetric DDoS attacks (exceeding 1 Tbps) in H1 2026, with a +519% surge quarter-over-quarter. It highlights a shift in attack vectors from botnet floods to reflection and amplification, with DNS-based attacks (DNS Floods and DNS Amplification) accounting for 34.3% of network-layer attacks and CLDAP floods surging +580% to become the #3 vector. Geopolitical events are noted as influencing attack targets, with the Media, Production & Publishing industry being the most attacked, and the Government sector seeing a significant rank jump. The report also discusses the short-lived nature of most attacks, emphasizing the need for automated, always-on protection, and mentions Cloudflare's free DDoS Botnet Threat Feed for Service Providers.
  2. Shutdowns, power outages, and conflict: a review of Q1 2026 Internet disruptionsThis post analyzes the impact of various real-world disruptions (government shutdowns, military actions, power outages, severe weather, cable damage, technical problems, unknown issues) on global internet connectivity during Q1 2026. It uses Cloudflare Radar data to illustrate traffic drops and network behavior in specific regions (Uganda, Iran, Republic of Congo, Ukraine, Middle East AWS regions). The analysis highlights how these events manifest as traffic anomalies and provides insights into the methods used for disruptions (e.g., filtering, IP address space changes).
  3. Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customersThis post introduces Programmable Flow Protection, a new capability for Magic Transit customers that allows them to write and deploy custom eBPF programs for DDoS mitigation. These programs can define custom logic for identifying and handling 'good' vs. 'bad' UDP packets, including stateful tracking and client challenges. The post details the use of eBPF, helper functions tailored for DDoS mitigation, and provides an example of a program that filters UDP packets based on a proprietary application header token. It highlights the ability to combine customer-specific protocol knowledge with Cloudflare's network capacity for more effective DDoS defense.
  4. 2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaultsThis post details the scale and evolution of DDoS attacks in 2025, including record-breaking volumetric attacks (31.4 Tbps) and hyper-volumetric HTTP DDoS attacks (205 Mrps) launched by the Aisuru-Kimwolf botnet. It highlights the significant increase in network-layer DDoS attacks (tripled year-over-year) and the role of infected Android TVs in botnets. The report also details the most-attacked industries (Telecommunications, Service Providers and Carriers) and locations, as well as top attack sources and networks, emphasizing the use of cloud computing platforms and infrastructure providers as attack sources. Cloudflare's autonomous DDoS defense systems are credited with automatically detecting and mitigating these attacks.
  5. Cable cuts, storms, and DNS: a look at Internet disruptions in Q4 2025This post details the analysis of Internet disruptions observed in Q4 2025, categorizing them by cause: government-directed shutdowns, cable cuts (Digicel Haiti, Cybernet/StormFiber, Camtel/MTN Cameroon/Orange Cameroun, Claro Dominicana), power outages (Dominican Republic, Kenya), and military action (Ukraine). It quantifies traffic drops and notes specific infrastructure impacts (e.g., PEACE submarine cable, WACS cable system). The analysis uses Cloudflare Radar data to track connectivity anomalies and provides context on the events.
  7. Cloudflare outage on December 5, 2025This post details an incident on December 5, 2025, where a change to increase the WAF body parsing buffer size to 1MB, combined with a subsequent change to disable an internal WAF testing tool, caused HTTP 500 errors for approximately 28% of customers. The root cause was a bug in the FL1 proxy's rules module where attempting to index a nil value in Lua resulted in an error when a killswitch was applied to a rule with an 'execute' action. The incident was resolved by reverting the change. The post also references a previous incident on November 18, 2025, and outlines planned resiliency projects including enhanced rollouts and versioning, streamlined break glass capabilities, and 'fail-open' error handling.
  8. Cloudflare's 2025 Q3 DDoS threat report -- including Aisuru, the apex of botnetsThis report details the scale and characteristics of DDoS attacks in Q3 2025, highlighting the Aisuru botnet's record-breaking hyper-volumetric attacks (up to 29.7 Tbps and 14.1 Bpps). It quantifies the increase in network-layer (71% of attacks, +87% QoQ) and HTTP-layer attacks (29% of attacks, -41% QoQ), and notes the rapid duration of most attacks (under 10 minutes). The report also identifies key attack sources (Indonesia leading) and attacked industries (IT & Services, Telecom, Gambling, Automotive, AI) and locations (Maldives, France) correlated with geopolitical events. While the post discusses the impact and scale of these attacks, it does not introduce new technical mitigation capabilities beyond existing programmable flow protection.
  9. Helping protect the 2025 Moldova electionsThis post details Cloudflare's real-time mitigation of significant DDoS attacks against the Moldovan Central Election Commission (CEC) and related election infrastructure during the 2025 parliamentary elections. It quantifies the attacks, noting over 898 million malicious requests mitigated against the CEC over a twelve-hour period, with peak attack rates reaching 324,333 requests per second. The post highlights the multi-wave nature of the attacks, categorizing them into 11 'chunks,' and describes the successful neutralization of both network and application-layer attacks that targeted official election services and public information channels. It also mentions the use of Cloudflare's Athenian Project expertise in onboarding and deploying mitigation strategies.
  10. Cloudflare incident on August 21, 2025This post details a network congestion incident caused by a single customer's traffic surge overwhelming Cloudflare's links to AWS us-east-1. It explains how AWS BGP prefix withdrawals exacerbated the issue, leading to packet loss and high latency. The incident response involved collaboration with AWS and manual traffic engineering. Remediations include developing traffic deprioritization mechanisms, expediting DCI upgrades, improving BGP traffic engineering coordination with AWS, and building a long-term per-customer network resource management system.
  11. How a volunteer-run wildfire site in Portugal stayed online during DDoS attacksThis post details the mitigation of two DDoS attacks against fogos.pt, a volunteer-run wildfire information site. The attacks peaked at 33,000 and 31,000 requests per second, with bandwidths of 1.7 Gbps and 849 Mbps respectively. The post analyzes the attack vectors, identifying one as likely proxy-based (unencrypted traffic) and the other from cloud machines. It highlights Cloudflare's automated mitigation systems, which blocked the attacks without disruption or manual intervention, and emphasizes the role of Project Galileo in providing these services at no cost to vulnerable public interest sites. The post also quantifies the significant traffic surges handled by fogos.pt during wildfire events, demonstrating the need for robust DDoS protection.
  12. MadeYouReset: An HTTP/2 vulnerability thwarted by Rapid Reset mitigationsThis post details the MadeYouReset (CVE-2025-8671) HTTP/2 vulnerability, which exploits server-sent stream resets to cause resource exhaustion. It explains how Cloudflare's existing defenses, developed in response to Rapid Reset and earlier HTTP/2 DoS attacks, already protect against MadeYouReset. The core mechanism of the attack involves tricking a server into resetting streams by sending frames that trigger protocol violations. The post also clarifies that Cloudflare's Pingora framework, when using the h2 Rust library version 0.4.11 or later, is not susceptible.
  13. Hyper-volumetric DDoS attacks skyrocket: Cloudflare’s 2025 Q2 DDoS threat reportThis post details the scale and trends of DDoS attacks observed in Q2 2025, including record-breaking volumetric attacks (7.3 Tbps, 4.8 Bpps), a surge in hyper-volumetric attacks (71 per day), and a 44% YoY increase in overall attacks. It highlights the continued pressure on critical infrastructure, particularly the Telecommunications, Service Providers, and Carriers sector. The report also quantifies the increase in Ransom DDoS threats and provides detailed breakdowns of top attacked locations, industries, and sources of DDoS attacks, including top ASNs for HTTP DDoS attacks. The data presented showcases the ongoing evolution and scale of Cloudflare's automated DDoS defenses.
  14. Defending the Internet: How Cloudflare blocked a monumental 7.3 Tbps DDoS attackThis post details the autonomous mitigation of a record-breaking 7.3 Tbps DDoS attack, primarily composed of UDP floods with smaller reflection attack vectors (QOTD, Echo, NTP, Portmap, RIPv1). It provides statistics on attack volume, duration, destination ports, and origin distribution (countries and ASNs). The post also outlines defense strategies and recommendations for avoiding becoming a reflection/amplification participant for various attack vectors.
  15. Targeted by 20.5 million DDoS attacks, up 358% year-over-year: Cloudflare’s 2025 Q1 DDoS Threat ReportThis post details the Q1 2025 DDoS Threat Report, highlighting a significant year-over-year increase in blocked DDoS attacks (358% YoY, 198% QoQ), reaching 20.5 million. It emphasizes the blocking of record-breaking hyper-volumetric attacks in April 2025, including a 4.8 Bpps UDP flood and a 6.5 Tbps UDP flood, demonstrating autonomous mitigation capabilities. The report details the prevalence of network-layer attacks (16.8M blocked), with 6.6M targeting Cloudflare's infrastructure directly. It also identifies emerging threats like CLDAP and ESP reflection/amplification attacks, with QoQ increases of 3,488% and 2,301% respectively. Threat actor analysis shows competitors as the primary motivator (39%), followed by state-level actors (17%) and disgruntled users (17%). The report also quantifies attack size and duration, noting that 99% of Layer 3/4 attacks are under 1 Gbps/1 Mpps and 89% end within 10 minutes.
  16. Improved Bot Management flexibility and visibility with new high-precision heuristicsThis post details the migration of Cloudflare's Bot Management heuristics engine from Lua to the Cloudflare Ruleset Engine. This migration enhances flexibility and precision by allowing for more complex rules, reduces deployment time for new heuristics, and provides Bot Management customers with greater visibility through Bot Detection IDs and tags. A specific example of improving a Golang TLS fingerprint heuristic by incorporating network context is provided, reducing false positives significantly.
  17. Extending Cloudflare Radar’s security insights with new DDoS, leaked credentials, and bots datasetsThis post introduces new datasets and visualizations to Cloudflare Radar for security insights. It details the refactoring of the Security & Attacks page into Application Layer and Network Layer sections. New DDoS insights include geographic and AS-level distribution maps and treemaps for application layer DDoS attacks. It also adds a graph for leaked credentials usage, showing the percentage of 'clean' vs. 'compromised' authentication requests, and a new dedicated Bots page in the Traffic section for monitoring bot activity.
  18. Banish bots from your Waiting Room and improve wait times for real usersThis post introduces two new capabilities for Cloudflare Waiting Room: integration with Turnstile for bot detection and mitigation, and Session Revocation. Turnstile provides an invisible challenge to identify bots and humans, with "Likely Bots" and "Bots" metrics available in analytics. Advanced Waiting Rooms can use an "Infinite Queue" to waste bot resources without impacting real users. Session Revocation allows for dynamic session ending based on user actions, improving throughput and fairness during high-demand events. The post details the technical implementation of these features and their impact on user experience and inventory protection.
  19. QUIC action: patching a broadcast address amplification vulnerabilityThis post details the discovery and mitigation of a QUIC broadcast amplification vulnerability. The vulnerability arose from the interaction of QUIC's initial packet handling, IP broadcast addresses, and Cloudflare's server configuration where Anycast IP ranges were bound to the loopback interface. This configuration caused QUIC initial packets sent to broadcast addresses to trigger a large response of initial packets, exceeding RFC amplification limits and causing server CPU amplification and reflection attacks. The mitigation involved adjusting the server configuration to prevent QUIC initial packets from being sent to broadcast addresses.
  20. Record-breaking 5.6 Tbps DDoS attack and global DDoS trends for 2024 Q4This post details a record-breaking 5.6 Tbps DDoS attack and global DDoS trends for 2024 Q4. It quantifies the increase in Cloudflare's network capacity (817% to 321 Tbps) and the growth in blocked DDoS attacks (53% YoY to 21.3 million). It breaks down attack types into Layer 3/4 (49%) and HTTP (51%), with SYN floods (38%), DNS floods (16%), and UDP floods (14%) being top L3/4 vectors. For HTTP attacks, botnets accounted for 73%, with HITV_ST_PLATFORM and hackney identified as problematic user agents. The post also highlights the disproportionate use of HEAD and DELETE HTTP methods in DDoS attacks compared to legitimate traffic, and the targeting of /wp-admin/ paths. It notes that 92% of HTTP DDoS attacks use HTTPS. Emerging threats like Memcached DDoS attacks saw 314% QoQ growth.
  21. TikTok ban takes hold: data reveals sharp traffic decline and rapid shift to alternativesThis post details the impact of the US ban on TikTok on Cloudflare's network traffic. It analyzes DNS traffic drops for TikTok and ByteDance-owned domains, as well as the surge in traffic for alternative platforms like RedNote (Xiaohongshu). The analysis uses data from Cloudflare's 1.1.1.1 DNS resolver and autonomous system traffic data. It also notes the global spread of this trend to other countries and the subsequent partial restoration of TikTok service.
  22. Grinch Bots strike again: defending your holidays from cyber threatsThis post details the evolution of bot threats, particularly AI bots and residential proxy networks, during the holiday shopping season. It provides statistics on bot traffic volume, types of bots (AI, ATO, proxy), and their modus operandi on e-commerce sites. It also outlines Cloudflare's defenses, including Bot Management, AI bot blocking, and account abuse detections, and offers recommendations for customers on how to protect themselves.
  23. Global elections in 2024: Internet traffic and cyber threat trendsThis post details the observed increase in DDoS attacks targeting political campaigns, parties, and election infrastructure during the 2024 global elections. It provides specific examples of attack volumes and tactics used in the United States, France, United Kingdom, Netherlands, Romania, South Africa, Portugal, Taiwan, and Japan. It also highlights the impact of government-imposed internet shutdowns in Comoros and Pakistan during election periods, and discusses general internet traffic trends observed on election days across various countries, correlating them with device usage patterns and broadcast media influence.
  24. Robotcop: enforcing your robots.txt policies and stopping bots before they reach your websiteThis post introduces 'Robotcop,' an extension of AI Crawl Control that allows customers to enforce their robots.txt policies against AI bots at the network level. It parses robots.txt files, matches rules against AI bot traffic, provides visibility into compliance and violations, and automatically translates robots.txt rules into WAF firewall rules for enforcement. This enhances DDoS mitigation and bot management by providing programmatic control over AI crawler access.
  25. Bigger and badder: how DDoS attack sizes have evolved over the last decadeThis post analyzes the evolution of DDoS attack sizes over the last decade, focusing on metrics like requests per second (rps), packets per second (pps), and bits per second (bps). It highlights an exponential growth trend, with significant increases in attack volume and sophistication. The post details the shift from IoT-based botnets to more powerful VM-based botnets and discusses Cloudflare's automated detection and mitigation strategies leveraging its global anycast network. It provides specific examples of record-breaking attacks and the metrics associated with them.
  26. Exploring Internet traffic shifts and cyber attacks during the 2024 US electionThis post details the mitigation of over 6 billion HTTP DDoS requests targeting US election-related websites, with no significant disruptions observed. It also explores traffic growth patterns on election day and DNS traffic trends related to political campaigns and news sites. The post highlights Cloudflare's Project Galileo, Athenian Project, and Cloudflare for Campaigns programs in providing cybersecurity resources to election infrastructure.
  27. DDoS threat report for 2024 Q3This post details the Q3 2024 DDoS threat landscape, reporting a significant increase in attack volume (nearly 6 million attacks, up 49% QoQ) and the mitigation of over 200 hyper-volumetric attacks exceeding 1 Tbps or 1 Bpps, with a new record attack of 4.2 Tbps. It breaks down attack types (network vs. application layer), duration, vectors (SYN flood, DNS flood, SSDP amplification), user agents used in HTTP attacks (Chrome impersonation being dominant), and HTTP attack attributes (DELETE method, non-standard 'HTTP/1.2' version). It also identifies top attacked locations (China) and industries (Banking & Financial Services).
  28. Training a million models per day to save customers of all sizes from DDoS attacksThis post details the evolution of Cloudflare's DDoS anomaly detection system. It introduces a naive volumetric model using z-scores, highlights its limitations with non-uniform traffic patterns and benign spikes, and then presents a more robust multi-dimensional approach. This new method identifies a dozen features that follow a normal distribution, are not correlated with volume, and deviate during attacks. It explains the use of scale normalization and Principal Component Analysis (PCA) to transform these features into a spherical representation, enabling the calculation of Mahalanobis distance as an anomaly score. This allows for global tuning of a single cutoff distance (λ) for anomaly detection, improving protection against novel and low-volume attacks.
  29. How Cloudflare auto-mitigated a world record 3.8 Tbps DDoS attackThis post details the autonomous mitigation of a record-breaking 3.8 Tbps DDoS attack. It explains the anatomy of Layer 3/4 DDoS attacks, focusing on CPU cycle and network bandwidth exhaustion. It describes how Cloudflare's Anycast network distributes attack traffic globally and how its egress capacity helps absorb volumetric attacks. The post highlights the generation of real-time signatures to match attack traffic and the use of kernel features for wire-speed packet dropping as key defense mechanisms. It also discusses the sources of attack traffic, including compromised MikroTik devices, DVRs, and ASUS routers.
  30. AI Everywhere with the WAF Rule Builder Assistant, Cloudflare Radar AI Insights, and updated AI bot protectionIntroduced an AI Assistant for the WAF Rule Builder, allowing natural language prompts to generate custom and rate-limiting rules. Added AI bot and crawler traffic insights to Cloudflare Radar. Enhanced AI bot blocking capabilities by expanding the 'block AI bots' button to include 27 new signatures of AI bots that do not respect robots.txt, converting this logic to a Cloudflare managed rule for real-time updates. This managed rule leverages a combination of machine learning and heuristics for improved detection rates and faster classification of AI bots. The new rule is adopted by over 90,000 zones and blocks 66 million requests daily. Support for configuring AI bots protection via Terraform is planned.
  31. A global assessment of third-party connection tamperingThis post details Cloudflare's research into global connection tampering, identifying 19 patterns of anomalous TCP connection closures that suggest third-party intervention. It presents macro-level analysis of these patterns across jurisdictions, validating findings against existing "on the ground" measurement efforts and revealing significant tampering activity in China, India, Turkmenistan, Russia, Iran, Peru, and Mexico. The post explains the technical mechanisms behind connection tampering, particularly the role of SNI in TLS, and introduces Cloudflare Radar's new dashboard and API for real-time visibility into TCP resets and timeouts.
  32. Exploring Internet traffic during the 2024 U.S. Republican National ConventionThis post details Cloudflare's analysis of internet traffic and cyberattacks during the 2024 U.S. Republican National Convention and the attempted assassination of Donald Trump. It quantifies DDoS attack volumes (rps) against political websites and news outlets, and measures traffic increases to media organizations following the assassination attempt. The post highlights the short duration of most DDoS attacks, emphasizing the need for automated mitigation systems. It also notes that while major political events may not always cause significant overall traffic shifts, they can correlate with increased traffic to news media and targeted attacks on political campaigns and policy organizations. The analysis uses data from Cloudflare Radar and its 1.1.1.1 resolver to illustrate these trends.
  33. DDoS threat report for 2024 Q2This post details the Q2 2024 DDoS threat landscape, observing a 20% year-over-year increase in DDoS attacks and a 10x increase in the number of fingerprints generated by automated defenses due to sophisticated and randomized attacks. It highlights the rise of Ransom DDoS attacks, reaching 16% of threatened customers in May 2024. The report identifies China as the most attacked country and Information Technology & Services as the most targeted industry. It also notes Argentina as the largest source of DDoS attacks. The post details network-layer attack vectors, with DNS-based attacks remaining the most common, and discusses the impact of generative AI on threat actor capabilities.
  34. French elections: political cyber attacks and Internet traffic shiftsThis post details the analysis of DDoS attacks targeting French political parties during the 2024 legislative election runoff. It quantifies the intensity and volume of these attacks, noting specific peaks in requests per second and daily totals. Additionally, it analyzes shifts in internet traffic patterns correlated with election results announcements, observing a significant drop in traffic at 20:00 local time on July 7, 2024, and a corresponding increase in mobile device traffic share. DNS trends for news outlets and social media are also examined, showing increased traffic during election periods.
  35. First round of French election: party attacks and a modest traffic dipThis post details the application of Cloudflare's DDoS mitigation capabilities to protect French political parties during elections. It quantures specific attack metrics (requests per second, total daily requests) for three distinct parties, illustrating the scale of attacks faced (up to 118,000 rps and 610 million daily requests). It also analyzes broader internet traffic trends during the election period, noting a modest dip after polls opened and a subsequent increase post-voting. The post references existing election-related cybersecurity insights and highlights the use of Cloudflare Radar for ongoing trend analysis.
  36. Internet insights on 2024 elections in the Netherlands, South Africa, Iceland, India, and MexicoThis post details the observation and analysis of DDoS attacks targeting Dutch political websites during the 2024 European Parliament election, peaking at 73,000 requests per second. It also analyzes traffic patterns during elections in Mexico, South Africa, and India, noting typical decreases in internet traffic during polling hours followed by increases as results are announced. Specific examples include a DDoS attack on a Mexican state electoral organization and traffic spikes related to election results in Mexico. For India, the post highlights mobile device usage trends during the extended election period.
  37. Dutch political websites hit by cyber attacks as EU voting startsThis post details the detection and mitigation of DDoS attacks targeting Dutch political websites during the European Parliament elections. It quantifies attack volumes in requests per hour and requests per second, providing specific peak metrics for two targeted websites. The post also contextualizes these attacks within broader geopolitical trends and references Cloudflare's DDoS threat report and Radar insights for election-related cyber activity. It reinforces the ongoing evolution of DDoS mitigation strategies to handle sophisticated, politically motivated attacks.
  38. Disrupting FlyingYeti's campaign targeting UkraineThis post details Cloudforce One's proactive disruption of the FlyingYeti threat actor's phishing campaign targeting Ukraine. It highlights the use of Cloudflare Workers and GitHub for malware delivery, exploitation of the WinRAR vulnerability (CVE-2023-38831), and the COOKBOX PowerShell malware. Cloudforce One's countermeasures, including detection, code takedowns, and collaboration with third parties, successfully delayed the campaign and prevented the threat actor from achieving their objectives. The post also provides analysis of the phishing site, the malicious RAR file, and decoy documents used for tracking.
  39. DDoS threat report for 2024 Q1This post details Cloudflare's Q1 2024 DDoS threat landscape, reporting a 50% YoY increase in mitigated attacks to 4.5 million. It highlights a 80% YoY surge in DNS-based DDoS attacks, making them the most prominent vector. The report also discusses the continued prevalence of Mirai-variant botnets, the largest attack mitigated reaching 2 Tbps, and the emergence of the HTTP/2 Continuation Flood vulnerability. Cloudflare's existing defenses are noted as unaffected by this new vulnerability, and the company is actively monitoring its impact.
  40. An Internet traffic analysis during Iran's April 13, 2024, attack on IsraelThis post analyzes internet traffic patterns in Israel and the Palestinian territories during Iran's April 13, 2024, attack. It observes a surge in traffic in Israel, predominantly mobile-driven, and a noticeable drop in traffic in the Palestinian territories. It also notes a decline in traffic in Iran, potentially linked to the conclusion of Ramadan. The post confirms no coordinated large cyberattack on Israeli domains protected by Cloudflare, but notes a general increase in application-layer attacks targeting the Government Administration sector over the past month.
  41. Advanced DNS Protection: mitigating sophisticated DNS DDoS attacksIntroduces the Advanced DNS Protection system, a new software-defined, stateful mitigation platform powered by flowtrackd, to specifically address sophisticated and randomized DNS-based DDoS attacks that traditional fingerprinting methods struggle with. This system runs autonomously on every Cloudflare server globally and gossips threat intelligence between instances within data centers. It complements existing DDoS defense systems and provides customizable options for customers. New DNS-centric data points have been added to the Network Analytics dashboard and GraphQL API for enhanced visibility into DNS traffic and attacks.
  42. Cyber attacks targeting Jewish and Holocaust educational websites surge by 872% in 2023This post details a significant surge in application-layer cyber attacks, including DDoS, targeting Jewish and Holocaust educational websites in 2023. It quantifies this increase by reporting over 35.7 million malicious HTTP requests mitigated, a 2,190% increase year-over-year. The percentage of mitigated requests relative to total inbound traffic grew by 872%, indicating a disproportionate rise in attacks against these specific sites compared to previous years. The post highlights the effectiveness of Cloudflare's Web Application Firewall (WAF) and DDoS mitigation capabilities in protecting these vulnerable resources.
  43. DDoS threat report for 2023 Q4This post details Q4 2023 DDoS trends, highlighting a 117% YoY increase in network-layer DDoS attacks and a significant surge in attacks targeting specific industries (Environmental Services, Banking, Media) and regions (Taiwan, Israel, Palestine) during geopolitical events and conferences. It also discusses the unprecedented scale of hyper-volumetric HTTP/2 attacks experienced in Q3 and Q4, with the largest attack reaching 201 million rps. The report quantifies the growth in network-layer attacks and the decline in HTTP DDoS requests compared to the previous year.
  44. Cyber Week: analyzing Internet traffic and e-commerce trendsThis post analyzes internet traffic and e-commerce trends during Cyber Week (Black Friday and Cyber Monday), providing detailed metrics on HTTP requests and DNS queries processed by Cloudflare. It highlights Cyber Monday as the highest traffic day of 2023 globally and in the US, with a 27% increase in HTTP requests compared to the previous year. The analysis also notes a 24% increase in daily DNS queries to 1.1.1.1 compared to August. While overall traffic peaked, the distribution varied by country and device type (mobile vs. desktop). The post also touches on DDoS attack volume during this period, noting it was the lowest daily fraction of traffic in November, but mentions previous record-breaking attacks related to the HTTP/2 Zero-Day vulnerability.
  45. DDoS threat report for 2023 Q3This post details the Q3 2023 DDoS threat landscape, highlighting a sophisticated and persistent attack campaign that exploited the HTTP/2 Rapid Reset vulnerability (CVE-2023-44487). It quantifies the scale of these attacks, noting thousands of hyper-volumetric HTTP DDoS attacks, with 89 exceeding 100 million requests per second (rps) and the largest peaking at 201 million rps. The post also reports a 65% increase in HTTP DDoS attack traffic and a 14% increase in L3/4 DDoS attacks, with the largest L3/4 attack reaching 2.6 Tbps. It discusses the role of VM-based botnets leveraging HTTP/2 Rapid Reset and compares their effectiveness to older IoT-based botnets. The report identifies top targeted industries (Gaming, Gambling, VoIP) and top sources of attacks (US, China, Brazil for HTTP; US, Germany, UK for L3/4), including normalized traffic data. It also provides insights into the technical mechanisms of HTTP/2 Rapid Reset attacks and the mitigation strategies employed by Cloudflare.
  46. Cyber attacks in the Israel-Hamas warThis post details Cloudflare's real-time detection and mitigation of large-scale DDoS attacks targeting Israeli and Palestinian websites during the Israel-Hamas war. It quantifies attack volumes (e.g., 1M rps against Israeli sites, 46% of traffic to Palestinian sites being DDoS attacks on Oct 7), identifies targeted industries (media, software, BFSI for Israel; banking, internet for Palestine), and highlights the use of Cloudflare's platform to protect critical information infrastructure. It also touches upon the exploitation of mobile app vulnerabilities and the distribution of malicious apps.
  47. Network flow monitoring is GA, providing end-to-end traffic visibilityThis post announces the general availability of Magic Network Monitoring, a cloud network flow monitor that provides end-to-end traffic visibility. It details how the product ingests and analyzes NetFlow and sFlow data from customer routers, providing metrics like traffic volume, source/destination IPs, ports, and protocols. A key technical contribution is the implementation of VarOpt reservoir sampling to improve the accuracy of traffic volume estimations, addressing issues with previous random sampling methods that led to overestimations due to the long-tail distribution of network flow data weights. The post also highlights how Magic Network Monitoring integrates with Magic Transit and Magic WAN for enhanced DDoS attack detection and mitigation.
  48. HTTP/2 Rapid Reset: deconstructing the record-breaking attackThis post details the HTTP/2 Rapid Reset attack, a record-breaking DDoS attack that exploited the RST_STREAM frame to generate over 201 million requests per second using a botnet of only 20,000 machines. It explains the HTTP/1.1 and HTTP/2 protocols, focusing on HTTP/2's stream multiplexing and the RST_STREAM frame's role in request cancellation. The post describes how attackers abused this feature to overwhelm servers, leading to significant traffic spikes. Cloudflare's mitigation strategies, including hardening systems and collaborating with Google and AWS for coordinated disclosure and vendor patching, are discussed. The article emphasizes the need for protocol-level defenses and enhanced rate limiting to prevent similar attacks in the future.
  49. HTTP/2 Zero-Day vulnerability results in record-breaking DDoS attacksThis post details the discovery and mitigation of a novel zero-day vulnerability in the HTTP/2 protocol, dubbed the 'HTTP/2 Rapid Reset' attack. The attack exploits the stream cancellation feature by rapidly sending and canceling requests, enabling hyper-volumetric DDoS attacks. Cloudflare mitigated a record-breaking attack exceeding 201 million requests per second using this vulnerability, with a relatively small botnet of ~20,000 machines. The post describes the technical mechanism of the attack and Cloudflare's development of new technology to mitigate it, as well as industry-wide patching efforts. It also discusses Cloudflare's role in observing these attacks first due to its robust defenses and the importance of responsible disclosure and information sharing.
  50. Internet traffic patterns in Israel and Palestine following the October 2023 attacksThis post analyzes internet traffic patterns and cyberattacks in Israel and Palestine following the October 2023 attacks. It details observed internet traffic surges and drops in both regions, the impact of network outages in the Gaza Strip, and a significant increase in DDoS attacks targeting Israel and Palestine. The analysis highlights specific attack metrics, such as requests per second and daily blocked requests, providing insights into the scale and nature of cyber threats during geopolitical events.
  51. DDoS threat report for 2023 Q2This post details the DDoS threat landscape for Q2 2023, highlighting an increase in sophisticated HTTP DDoS attacks, a surge in DNS attacks, and a significant rise in attacks targeting cryptocurrency companies. It also covers the emergence of hacktivist alliances and their impact on various industries, as well as the increasing sophistication of randomized HTTP DDoS attacks and DNS Laundering attacks. Specific attack vectors and trends discussed include ACK flood attacks from Mirai-variant botnets, hacktivist campaigns by groups like Killnet and Anonymous Sudan, and the exploitation of the Mitel vulnerability (CVE-2022-26143). The report also notes an increase in attack durations and the sophistication of randomized HTTP DDoS attacks mimicking browser behavior.
  52. SLP: a new DDoS amplification vector in the wildThis post details the discovery of CVE-2023-29552, a new DDoS reflection/amplification attack vector leveraging the Service Location Protocol (SLP). SLP has an amplification factor of up to 2,200x. Cloudflare customers are protected by its automated DDoS protection system. Network operators are advised to block UDP port 427 to prevent exploitation.
  53. DDoS threat report for 2023 Q1This post details the evolution of Cloudflare's DDoS mitigation capabilities in Q1 2023, highlighting the emergence of hyper-volumetric attacks leveraging high-performance botnets comprised of Virtual Private Servers (VPS) instead of IoT devices. It discusses the mitigation of a record-breaking 71 million requests per second attack and a 1.3 Tbps attack targeting a South American Telecommunications provider. The post also details Cloudflare's collaboration with cloud computing providers to dismantle VPS-based botnets and the introduction of a Botnet Threat Feed. Key statistics on Ransom DDoS attacks, targeted countries (Israel, US, Finland), and industries (Internet, Marketing & Advertising, Computer Software) are presented.
  54. Killnet and AnonymousSudan DDoS attack Australian university websites, and threaten more attacks — here’s what to do about itThis post details Cloudflare's observation and mitigation of DDoS attacks targeting Australian universities, attributed to Killnet and AnonymousSudan. It explains the nature of these hacktivist groups, their collaboration methods, and the increasing audacity in their targets. The post also provides specific recommendations for organizations to protect themselves against DDoS attacks, including leveraging Cloudflare's managed rules, firewall rules, rate limiting, bot management, and ensuring origin security. It reiterates Cloudflare's commitment to providing unmetered and unlimited DDoS protection.
  55. Super Bot Fight Mode is now configurable!Super Bot Fight Mode has been rewritten and integrated into the new WAF as a managed ruleset, similar to OWASP Core Ruleset and Cloudflare Managed Ruleset. This allows for configuration via 'skip' rules within Custom Rules, enabling exceptions for specific traffic. A new configuration option has been added to securely allow WordPress loopback requests. Future plans include migrating the original Bot Fight Mode to the new WAF for Free plan customers.
  56. Announcing WAF Attack Score Lite and Security Analytics for business customersIntroduces "WAF Attack Score Lite" and "Security Analytics" for Business plan customers. WAF Attack Score Lite uses a machine learning model trained on WAF Managed Rules data to classify HTTP requests into four types: Attacks, Likely Attacks, Likely Clean, and Clean. It specifically targets SQL Injection (SQLi), Cross Site Scripting (XSS), and Remote Code Execution (RCE) attacks. The `cf.waf.score.class` field is exposed for use in WAF Custom Rules and Rate Limiting Rules. Security Analytics provides a new dashboard for comprehensive traffic visibility, investigating false negatives, and hardening security configurations. The post details a common use case combining bot score with WAF Attack Score for automated attack mitigation.
  57. One year of war in Ukraine: Internet trends, attacks, and resilienceThis post analyzes the impact of the war in Ukraine on internet traffic and resilience, detailing traffic shifts, cyberattacks, and infrastructure disruptions. It highlights the resilience of Ukraine's networks due to widespread connectivity and numerous IXPs, and the significant growth of Starlink traffic. The analysis includes specific city-level traffic drops and outages, ISP-level disruptions, and the impact of energy infrastructure attacks. It also touches upon application-layer cyberattacks targeting government, financial services, and media.
  58. Cloudflare mitigates record-breaking 71 million request-per-second DDoS attackThis post details Cloudflare's mitigation of a record-breaking 71 million requests per second (rps) HTTP/2-based DDoS attack, which was 54% higher than the previous record. The attack originated from over 30,000 IP addresses across numerous cloud providers. Cloudflare also announced a free Botnet threat feed for service providers to help them combat attacks originating from their own IP space.
  59. Uptick in healthcare organizations experiencing targeted DDoS attacksThis post details the observed increase in targeted DDoS attacks against healthcare organizations by the pro-Russian hacktivist group Killnet. It describes the nature of these attacks, including HTTP DDoS and varying attack methods and sources, and highlights Cloudflare's automatic mitigation of these threats. The post also provides specific recommendations for healthcare organizations to enhance their security posture, including optimizing DDoS Managed Rules, enabling Adaptive DDoS Protection, deploying firewall and rate-limiting rules, securing origins, and enabling DDoS alerting.
  60. Cloudflare DDoS threat report for 2022 Q4This post provides a Q4 2022 DDoS threat report, detailing trends in volumetric, ransom, and application-layer DDoS attacks. It highlights an increase in HTTP DDoS traffic YoY, surges in volumetric attacks, and a rise in ransom DDoS attacks. The report also details industry and country-specific attack targets and introduces changes to reporting methodologies for improved accuracy. It mentions the exploitation of HTTP/2's RST_STREAM frame for record-breaking attack rates.
  61. More bots, more treesThis post details the technical evolution of Cloudflare's Bot Fight Mode. It describes the limitations of the previous heuristic engine and the development of a new rules system built on the highly performant Ruleset Engine, which powers the WAF, Transform Rules, and Cache Rules. This new framework allows for more complex rules to catch elusive bots without impacting legitimate traffic. The data gathered from these new detections are used to train the Machine Learning engine. The post also highlights the reduction in time bots spend in challenges, indicating increased efficiency and cost-effectiveness for bot operators, leading to more trees being planted.
  62. The latest on attacks, traffic patterns and cyber protection in UkraineThis post details the impact of the Russian invasion of Ukraine on cyberattacks and internet infrastructure. It highlights a significant spike in application layer firewall mitigated attacks and DDoS attacks targeting Ukrainian websites, with DDoS traffic comprising over 80% of traffic to .ua domains on some days. Cloudflare provided free services to Ukrainian government and infrastructure providers, protecting approximately 130 domains, and expedited onboarding of 54 non-profits to Project Galileo. The post also discusses the importance of global network resilience, the demand for zero trust solutions due to physical security concerns, and the manipulation of internet access through rerouting traffic through Russia. It tracks dozens of internet outages in Ukraine and notes specific instances of ISP outages coinciding with significant events. The post also details instances of internet traffic being rerouted through Russia, imposing Russian controls, surveillance, and censorship.
  63. 2022 US midterm elections attack analysisThis post analyzes attack data from Cloudflare Radar related to the 2022 US midterm elections, focusing on traffic patterns and attack types mitigated by the Web Application Firewall (WAF) for participants in the Athenian Project and Cloudflare for Campaigns. It details the increase in SQL Injection and HTTP Anomaly attacks, the geographical origin of these attacks (predominantly US-based), and the overall traffic ramp-up around Election Day. For Athenian Project participants, attack traffic remained consistent until a surge in SQLi and HTTP Anomaly attacks in the week leading up to Election Day. For Cloudflare for Campaigns participants, traffic and attack volumes increased earlier, with a more diverse geographical origin of attacks.
  64. Internet disruptions overview for Q3 2022This post details observed Internet disruptions during Q3 2022, categorizing them by government-directed shutdowns and physical events. It provides specific examples from Iraq, Cuba, Afghanistan, Sierra Leone, Somaliland, India, and Iran, including traffic graphs and network provider data (AS numbers) for observed outages. The analysis highlights the use of internet shutdowns as a tool for control and suppression of protests, and the impact of these events on network connectivity.
  65. Cloudflare DDoS threat report 2022 Q3This post details a 2.5 Tbps DDoS attack targeting Wynncraft, a Minecraft server, which was mitigated by Cloudflare Spectrum. It highlights the increasing frequency and scale of multi-terabit attacks, the prevalence of Mirai botnet variants, and trends in application-layer (HTTP) and network-layer (L3/4) DDoS attacks, including geographical and industry-specific targeting. It also discusses ransom DDoS attacks and the methodology for calculating these trends.
  66. Announcing Turnstile, a user-friendly, privacy-preserving alternative to CAPTCHAIntroduces Turnstile, a new product offering a privacy-preserving, user-friendly alternative to CAPTCHA. Turnstile leverages existing Managed Challenge technology and integrates with Private Access Tokens to reduce data collection. It provides a simple API for websites to replace CAPTCHAs, offering implicit and explicit rendering options, and includes analytics. The product is offered for free to improve the internet.
  67. Introducing Cloudflare’s free Botnet Threat Feed for service providersIntroduces a free Botnet Threat Feed for service providers, allowing them to identify IP addresses within their networks that have participated in HTTP DDoS attacks observed by Cloudflare. This feed aims to help service providers crack down on abusers, take down botnet nodes, reduce abuse-driven costs, and ultimately decrease the volume and force of DDoS attacks. The post explains Cloudflare's unique vantage point on DDoS attacks due to its large customer base and the nature of HTTP requests, which do not use spoofed IPs. It highlights how service providers can leverage this intelligence to mitigate attacks originating from their infrastructure.
  68. Introducing Advanced DDoS AlertsIntroduced Advanced DDoS Alerts for HTTP and L3/4 attacks, allowing customers to customize notifications based on specific Internet properties (zones, hostnames, IP prefixes), attack size (RPS, PPS, Mbps), and protocols. This provides more granular control and reduces alert noise compared to standard DDoS alerts, enabling customers to verify mitigation effectiveness and availability in real-time.
  69. Introducing Cloudflare Adaptive DDoS Protection - our new traffic profiling system for mitigating DDoS attacksIntroduced Adaptive DDoS Protection, a new system that profiles unique customer traffic patterns to enhance DDoS mitigation. It learns traffic behaviors over seven days using predefined dimensions (source country, user agent, IP protocol, etc.) and calculates 95th percentile maximal rates. This profiling is asynchronous and distributes compact profile representations across the network. It also leverages ML-generated Bot Scores to distinguish legitimate traffic spikes from automated ones. Adaptive DDoS Protection offers HTTP Adaptive DDoS Protection for WAF/CDN Enterprise customers and L3/4 Adaptive DDoS Protection for Magic Transit and Spectrum Enterprise customers. Rules are deployed in log mode initially, allowing customers to observe and tune sensitivity before enabling mitigation.
  70. Mantis - the most powerful botnet to dateThis post introduces the 'Mantis' botnet, responsible for the largest HTTPS DDoS attack observed (26 million requests per second) using only 5,000 bots. It details Mantis's evolution from the Meris botnet, its use of hijacked VMs and powerful servers, and its attack patterns targeting specific industries and geographic locations. It also reiterates Cloudflare's existing HTTP DDoS Managed Ruleset and recommends onboarding HTTP applications to WAF/CDN for L7 protection.
  71. Introducing Location-Aware DDoS ProtectionIntroduces Location-Aware DDoS Protection, a new feature that leverages geographic origin of traffic as a signal for attack detection and mitigation. This feature is available in beta for Enterprise customers subscribed to Advanced DDoS. It works by learning where legitimate traffic originates and flagging spikes from unexpected locations. It also integrates with Machine Learning models to identify automated traffic. Customers can enable and configure the sensitivity of this rule within the Security Overview dashboard.
  72. DDoS attack trends for 2022 Q2This post details the observation of a record-breaking 26 million request per second HTTPS DDoS attack in Q2 2022, which Cloudflare automatically detected and mitigated. It also highlights trends in Ransom DDoS attacks, application-layer DDoS attacks (including industry and geographic targets), and network-layer DDoS attacks, noting increases in attack volume and duration.
  73. Cloudflare mitigates 26 million request per second DDoS attackThis post details Cloudflare's mitigation of a record-breaking 26 million requests per second HTTPS DDoS attack. It highlights the attack's origin from a botnet of hijacked virtual machines and powerful servers, contrasting it with less powerful IoT botnets. The post also discusses the increased resource cost of HTTPS DDoS attacks and provides statistics on the attack's origin countries, networks, and the botnet's size and per-node RPS. It emphasizes the importance of automated, always-on DDoS protection.
  74. In Ukraine and beyond, what it takes to keep vulnerable groups onlineThis post details the analysis of cyberattacks experienced by organizations protected under Project Galileo, with a specific focus on attacks against organizations in Ukraine. It highlights a significant growth in DDoS attack activity after the start of the conflict, with mitigated DDoS traffic for Ukrainian organizations reaching as much as 90% of total traffic during one attack. The post also analyzes WAF-mitigated traffic, noting SQLi as a frequent attack vector against journalism organizations and HTTP anomalies as the largest WAF rule type across all regions. It provides data on traffic growth for various organization types and attack methods by region and organization type, emphasizing the role of Cloudflare's WAF and DDoS mitigation in protecting vulnerable groups.
  75. Cloudflare blocks 15M rps HTTPS DDoS attackThis post details the mitigation of a 15.3 million request-per-second (rps) HTTPS DDoS attack, highlighting the increased computational cost of HTTPS attacks. The attack originated from a botnet of approximately 6,000 bots across 112 countries, with a significant portion coming from data centers. Cloudflare's autonomous, software-defined systems detected and mitigated the attack without human intervention, using asynchronous traffic sampling and data streaming algorithms for analysis and real-time signature creation.
  76. Cloudflare partners with Kentik to enhance on-demand DDoS protectionThis post announces a partnership with Kentik to integrate Kentik's network observability with Cloudflare's Magic Transit for on-demand DDoS protection. This integration allows customers to procure and deploy both services from a single vendor, simplifying the process of detecting and mitigating DDoS attacks. The combined solution offers SaaS-based DDoS protection with over 121 Tbps of capacity.
  77. DDoS Attack Trends for 2022 Q1This post provides a Q1 2022 DDoS trends report, detailing a massive spike in application-layer DDoS attacks (164% YoY, 135% QoQ) and a decrease in network-layer DDoS attacks (58% QoQ, 71% YoY). It highlights a new zero-day reflection attack with a 220 billion percent amplification factor and notes a decrease in ransom DDoS attacks. The report also details attack origins and targets in the Russian and Ukrainian cyberspace, and identifies the US as the top source of HTTP DDoS attacks for Q1 2022, with a significant QoQ increase.
  78. The end of the road for Cloudflare CAPTCHAsThis post details the development and deployment of Cloudflare's Managed Challenge platform, which significantly reduces reliance on CAPTCHAs. It introduces a new response option for Firewall rules that adaptively challenges visitors based on their behavior, using a series of non-interactive JavaScript challenges and machine learning models. This platform has reduced CAPTCHA usage by 91% and aims to reduce it to less than 1% by the end of the year, improving user experience by reducing challenge time from an average of 32 seconds to 1 second. The post also highlights the transition of the CAPTCHA option to 'Legacy CAPTCHA' in the dashboard.
  79. Application security: Cloudflare’s viewThis post analyzes application security trends observed across Cloudflare's network, detailing the types and sources of mitigated traffic. It highlights that 8% of all Cloudflare HTTP traffic is mitigated, with Layer 7 DDoS mitigation being the largest contributor (66.0%). Custom WAF Rules (19.0%) and Rate Limiting (10.5%) are also significant. The post identifies HTTP anomalies as the most common attack vector (54.5%), followed by Vendor Specific CVEs (11.8%) and Information Disclosure (10.4%). It also notes the continued reliance on IP address-based access lists in custom WAF rules (64.9% of rules use 'ip'). Bot traffic accounts for 38% of all HTTP requests.
  80. Packet captures at the edgeThis post announces the general availability of on-demand packet captures from Cloudflare's global network for Magic Transit and Magic WAN customers. It explains how packet captures are used for network debugging and security analysis, highlights the visibility gaps created by network fragmentation, and details the technical implementation of the new feature. The implementation leverages nftables for filtering, nflog for logging packets from the kernel to userspace, and tcpdump to generate pcap files from these logs. Packet captures are delivered directly from Cloudflare machines to a customer-chosen cloud storage service.
  81. Envoy Media: using Cloudflare's Bot Management & MLThis post details how Envoy Media Group leverages Cloudflare's Bot Management and its associated machine learning capabilities to filter out automated traffic. Envoy integrates the bot score (1-99) as a custom header into their Revstr rules engine to dynamically adjust user experiences (e.g., longer forms for suspicious traffic). They also ingest the bot score into their data warehouse and ML models to predict conversion rates, leading to a 15% increase in model precision. The bot score is now a standard component in 76 media buying and UX optimization reports and 9 ML models at Envoy.
  82. Announcing Friendly BotsIntroduces 'Friendly Bots,' a new feature that allows customers to define and manage lists of 'friendly' bots. This feature enables instant auto-validation of traffic from specified IP lists, rDNS, or machine learning profiles, providing granular control over how these bots are handled (allow, rate limit, log). This complements the existing Verified Bots program by extending validation capabilities to smaller-scale or custom bots, thereby reducing false positives and improving crawlability. The feature integrates with the Cloudflare dashboard and Workers platform for flexible policy creation and response actions.
  83. CVE-2022-26143: A Zero-Day vulnerability for launching UDP amplification DDoS attacksThis post details the analysis and mitigation of CVE-2022-26143, a zero-day vulnerability in Mitel MiCollab that enables UDP amplification DDoS attacks. It describes the exploit mechanism, the amplification factor achieved, and the deployment of emergency mitigation rules using Magic Firewall with the expression `(udp.dstport eq 10074)`. It also explains Cloudflare's autonomous DDoS detection and mitigation systems, including BGP Anycast routing, asynchronous traffic sampling, data streaming algorithms, real-time signature creation, and inline mitigation rule compilation.
  84. CVE-2022-26143: TP240PhoneHome reflection/amplification DDoS attack vectorThis post details a new DDoS attack vector exploiting a vulnerability in Mitel MiCollab systems (CVE-2022-26143). It explains how the TP-240 VoIP processing interface card's test facility can be abused as a UDP reflection/amplification source on UDP port 10074. The analysis highlights the unique single-packet initiation capability, leading to extremely high amplification ratios (up to 4,294,967,296:1) and sustained attacks of up to 14 hours. It also discusses the collateral impact on affected systems and provides recommended mitigation steps for network operators and Mitel system owners, including reconnaissance, remediation, and the implementation of standard DDoS defense tools and best practices.
  85. Internet traffic patterns in Ukraine since February 21, 2022This post details the analysis of internet traffic patterns in Ukraine during the initial phase of the conflict, correlating traffic drops and increases with observed events and population movements. It also provides an overview of cyberattacks against Ukrainian domains and networks, specifically focusing on Layer 7 DDoS attacks, firewall rule mitigations, and IP threat reputation blocking. Additionally, it analyzes Layer 3/4 DDoS traffic hitting Cloudflare's Kyiv data center, noting that while relatively small, these attacks can be devastating to smaller services.
  86. Cloudflare customers on Free plans can now also get real-time DDoS alertsExtends real-time HTTP DDoS attack alerts to Cloudflare Free plan users. Previously, this feature was only available to Pro plan customers and higher. The post details how to configure these alerts via the Cloudflare dashboard's Notifications section.
  87. DDoS Attack Trends for Q4 2021This post details DDoS attack trends observed in Q4 2021, highlighting an increase in ransom DDoS attacks (29% YoY, 175% QoQ), application-layer attacks (especially targeting Manufacturing with a 641% QoQ increase), and network-layer attacks. It notes the emergence of the Meris botnet and record-breaking HTTP attacks (17.2M rps) and network-layer attacks (nearly 2 Tbps). The post also discusses the prevalence of SYN floods and UDP floods as attack vectors, and a significant increase in SNMP attacks. It provides insights into attack origins (China for application-layer, Moldova for network-layer) and targets (US for application-layer).
  88. How Cloudflare security responded to Log4j 2 vulnerabilityThis post details Cloudflare's internal response to the Log4j 2 vulnerability (CVE-2021-44228). It covers the process of identifying vulnerable internal systems (ElasticSearch, LogStash, Bitbucket), applying mitigation strategies (removing JndiLookup class, setting log4j2.formatMsgNoLookups), and analyzing external reports. The post emphasizes the defense-in-depth approach, including restricted outbound traffic and the use of Cloudflare Access for internal services, concluding that Cloudflare was not compromised.
  89. How We Used eBPF to Build Programmable Packet Filtering in Magic FirewallThis post details the technical integration of eBPF with nftables to enhance Magic Firewall's packet filtering. It explains how to leverage the `xt_bpf` extension within nftables by constructing netlink/netfilter messages to embed eBPF programs. The post provides an example eBPF program for packet filtering and discusses the use of Cilium's eBPF library for loading these programs. This integration allows for custom C programs to execute in the kernel for advanced matching logic within the firewall ruleset.
  90. The Grinch Bot is Stealing Christmas!This post introduces the concept of 'Grinch Bots' as a seasonal term for bots that target online inventory during the holiday season. It quantifies the scale of bot traffic observed during Black Friday and Cyber Monday, highlighting the surge in bot requests and the effectiveness of Cloudflare's Bot Management and Rate Limiting solutions. It also details the use of JS Challenges and the blocking of over 150 billion threats on Black Friday. Finally, it introduces Cloudflare's free 'Bot Fight Mode' as a solution for smaller sites, which employs a tarpit challenge to increase bot operator costs and offsets carbon emissions by planting trees.
  91. Attack Maps now available on RadarIntroduces Radar Maps, a new data visualization feature on Cloudflare Radar, to represent geographical distribution of application-level attacks (origin and target) and attack flows using Sankey diagrams. These visualizations are built using Cloudflare Workers and Workers KV, providing a real-time view of cyber threats.
  92. Cloudflare blocks an almost 2 Tbps multi-vector DDoS attackThis post details the mitigation of a 2 Tbps multi-vector DDoS attack combining DNS amplification and UDP floods. It highlights the use of out-of-path traffic analysis for sub-second detection, real-time signature generation, and ephemeral mitigation rule propagation. Crucially, it describes the in-line deployment of mitigation rules into the Linux kernel's eXpress Data Path (XDP) for wire-speed packet dropping, showcasing the integration of eBPF for advanced network-layer DDoS defense.
  93. A Brief History of the Meris BotnetThis post details the analysis of the Meris botnet, a significant DDoS threat. It describes the botnet's origin (MikroTik routers exploiting CVE-2018-14847), its scale (up to 17.2 million RPS), attack vectors (HTTP pipelining, SOCKS proxies), and targets (industries and countries). It also highlights Cloudflare's automated detection and mitigation strategies, including new rules deployed to enhance defenses and provide threat intelligence. The post contrasts Meris with the Mirai botnet.
  94. DDoS Attack Trends for Q3 2021This post details the DDoS attack trends observed in Q3 2021, focusing on both application-layer (L7) and network-layer (L3/4) attacks. It highlights the emergence of the Meris botnet for large HTTP attacks and Mirai variants for terabit-strong network-layer attacks. The analysis includes attack trends by industry, source and target countries for L7 attacks, and by attack rate (bit and packet) for L3/4 attacks, noting an increase in larger attacks. Specific attack vectors like DTLS amplification and ransom DDoS attacks on VoIP providers are also mentioned.
  95. Update on recent VoIP attacks: What should I do if I’m attacked?This post details recent attack patterns targeting VoIP infrastructure, including TCP floods, UDP floods/reflection targeting SIP, and application-layer SIP attacks. It provides guidance on preparation (always-on DDoS mitigation, positive security model, custom strategies, employee education) and response (do not pay ransom, notify Cloudflare, notify law enforcement). It highlights Cloudflare's Magic Transit for network-level protection and its capacity to mitigate these specific VoIP attacks.
  96. May I ask who’s calling, please? A recent rise in VoIP DDoS attacksThis post details the analysis of recent multi-vector DDoS attacks targeting VoIP providers, combining L7 attacks on websites/APIs with L3/4 attacks on VoIP infrastructure. It explains how attackers exploit UDP and SIP protocols for DDoS, including SIP reflection attacks. The post highlights Cloudflare's Magic Transit service for protecting VoIP infrastructure, detailing its Anycast architecture, out-of-path detection, and real-time threat intelligence sharing. It also describes the use of XDP in the Linux kernel for wirespeed packet dropping and the deployment of specific mitigation rules for UDP traffic to identify valid SIP traffic.
  97. Cloudflare thwarts 17.2M rps DDoS attack — the largest ever reportedThis post details a 17.2 million rps DDoS attack, the largest ever reported, and how Cloudflare's autonomous edge DDoS protection systems automatically detected and mitigated it. It introduces the 'dosd' daemon, a home-grown software-defined daemon running in every server, which analyzes traffic samples out-of-path for asynchronous DDoS detection without impacting performance. The system generates real-time signatures for mitigation rules and propagates them to the most optimal stack layer (e.g., L4 iptables for volumetric HTTP attacks) for cost-efficiency and scale. The post also analyzes the resurgence of Mirai and new botnets, detailing attack origins, traffic volumes, and the increase in Mirai-based attacks, and provides recommendations for protection.
  98. DDoS attack trends for 2021 Q2This post analyzes DDoS attack trends observed on Cloudflare's network during Q2 2021. It details the increase in ransomware and ransom DDoS attacks, the rise in HTTP DDoS attacks targeting government and consumer services, and emerging threats like QOTD and QUIC amplification attacks. It also breaks down network-layer DDoS attacks by size (bit rate and packet rate) and duration, highlighting the prevalence of smaller, short-duration attacks and the increasing volume of larger attacks. The post emphasizes the need for always-on, automated DDoS protection.
  99. DDoS attack trends for 2021 Q1This post provides a detailed analysis of DDoS attack trends observed during Q1 2021. It breaks down application-layer attacks by industry (Telecommunication, Consumer Services, Security and Investigations) and source/target country (China, US, Morocco), and highlights the prevalence of Ransom DDoS attacks on Pro and Business plans. For network-layer attacks, it details monthly attack volume, peak attack sizes (300-400 Gbps), attack duration (over 90% under one hour), and common attack vectors (SYN, RST, UDP, DNS amplification). Emerging threats like QUIC version negotiation floods and attacks targeting Jenkins and TeamSpeak3 servers are also identified. The post introduces a new Radar DDoS Report page built on Jupyter, Clickhouse, and Workers for automated data analysis.
  100. Introducing Super Bot Fight ModeIntroduces Super Bot Fight Mode for Pro and Business plans, enhancing bot protection with advanced features. Pro plan gains Bot Report with real-time analytics and controls to challenge/block 'definitely automated' traffic, enable JavaScript Detections, and include/exclude verified bots. Business plan gains Bot Analytics for more visibility into traffic categorization and mitigation effectiveness, and the ability to target 'likely automated' traffic (including ML-scored requests) with challenges or blocks. Enterprise Bot Management continues to offer advanced features like granular bot scores and anomaly detection.
  101. A deep-dive into Cloudflare’s autonomous edge DDoS protectionThis post introduces and details Cloudflare's autonomous edge DDoS protection system powered by `dosd`. It explains how `dosd` analyzes packet and HTTP request samples at the edge to detect L3/4 and L7 DDoS attacks in real-time. The system pushes mitigation rules to the most cost-efficient location in the Linux stack, utilizing XDP and iptables for wire-speed packet dropping. It complements existing core detection mechanisms like Gatebot and introduces new edge sampling rates for faster analysis and mitigation. The post also discusses the life of a packet through Cloudflare's network, from BGP Anycast to XDP, Unimog, iptables, and the HTTP reverse proxy, highlighting the integration of these components for comprehensive DDoS defense.
  102. Cloudflare recognized as a 'Leader' in The Forrester Wave for DDoS Mitigation SolutionsThis post details Cloudflare's DDoS mitigation capabilities, highlighting the evolution of their automated systems. Key technical contributions include: the use of eBPF via XDP for rapid, packet-level inspection and mitigation (dosd); TCP state classification engine (flowtrackd) for L3/L4 attacks; IP Jails leveraging iptables for cost-efficient L4 mitigation of L7 attacks; and the continuous analysis of attack patterns across layers 3-7. It also mentions the development of Firewall Analytics and Network Analytics dashboards for customer visibility and real-time DDoS alerts.
  103. Flow-based monitoring for Magic TransitIntroduces flow-based monitoring for on-demand Magic Transit customers. This feature allows Cloudflare to ingest NetFlow or sFlow data from customer routers to detect volumetric DDoS attacks. Upon detection, customers are notified (email, webhook, PagerDuty) and can choose to manually or automatically activate Magic Transit for mitigation. This aims to reduce the time to mitigation for on-demand users by enabling proactive detection before significant business impact.
  104. Network-layer DDoS attack trends for Q4 2020This post analyzes network-layer DDoS attack trends for Q4 2020, noting an increase in large attacks (over 500Mbps and 50K pps), a 3-10x increase in protocol-based attacks, and a significant rise in attack duration for some attacks. It details specific attack vectors like NetBIOS, ISAKMP, and SPSS, and highlights global DDoS activity hotspots in Mauritius, Romania, and Brunei. A unique 'Beat' attack inspired by acoustics is also discussed.
  105. Ransom DDoS attacks target a Fortune Global 500 companyThis post details a specific Ransom DDoS (RDDoS) attack scenario against a Fortune Global 500 company, highlighting the attacker's tactics (ransom emails, staged attacks) and the victim's experience with an on-demand DDoS protection service versus Cloudflare's always-on Magic Transit. It emphasizes the critical importance of automated, always-on DDoS protection for critical network infrastructure, the benefits of rapid onboarding, and the value of detailed attack analytics provided by Cloudflare. Recommendations include utilizing automated always-on DDoS protection, collaborating with vendors on threat models, and educating employees on handling ransom demands.
  106. Beat - An Acoustics Inspired DDoS AttackThis post details the analysis and mitigation of a novel 'Beat' DDoS attack that mimicked acoustic wave interference to create a rhythmic packet rate. It reverse-engineers the attack's mathematical formula and explains how Cloudflare's flowtrackd system, designed for asymmetric routing topologies like Magic Transit, detected and dropped out-of-state ACK packets, effectively mitigating the attack. It also contrasts this with previous stateful TCP tracking methods used in WAF/CDN and Spectrum.
  107. Trend data on the SolarWinds Orion compromiseThis post details the analysis of a sophisticated supply chain attack leveraging SolarWinds' Orion IT monitoring software. It focuses on the malware's network traffic obfuscation techniques, specifically its use of a Domain Generation Algorithm (DGA) to construct and resolve subdomains of `avsvmcloud[.]com`. The post analyzes DNS query traffic to identified malicious hostnames observed on Cloudflare's 1.1.1.1 resolver, showing trends in DGA domain generation, geographic distribution of queries, and the evolution of C2 domains. It also describes how Cloudflare Gateway's DNS filtering was used to block these threats for customers.
  108. Network-layer DDoS attack trends for Q3 2020This post provides a quarterly analysis of network-layer DDoS attack trends observed on Cloudflare's network in Q3 2020. It details the increase in attack frequency (4x from Q1), the rise of protocol-specific attacks (mDNS, Memcached, Jenkins), and the typical size and duration of attacks. It also discusses the geographical distribution of attacks and the challenges of analyzing spoofed IP addresses. The analysis highlights the continued dominance of SYN, RST, and UDP floods, alongside a significant increase in mDNS attacks (2,680%). The post also touches upon ransom-driven DDoS attacks and the impact of botnets like Moobot.
  109. Announcing Spectrum DDoS Analytics and DDoS Insights & TrendsIntroduced DDoS Insights & Trends card for dynamic attack trend analysis and Group-by Filtering for customized traffic analysis in the Network Analytics dashboard for Spectrum customers. Expanded Network Analytics to Spectrum customers on the Enterprise plan, including those using Cloudflare's Anycast IPs. Added new visualizations for TCP flag distribution and other dashboard enhancements like log export and zoom-in features.
  110. Know When You’ve Been DDoS’dIntroduced real-time DDoS attack alerts for all Cloudflare customers on paid plans. Alerts are delivered via email (Pro, Business, Enterprise) and PagerDuty (Business, Enterprise). Two types of alerts are available: HTTP DDoS alerts (for WAF/CDN services) and L3/4 DDoS alerts (for Spectrum, Spectrum BYOIP, Magic Transit, with L3/4 alerts coming soon for Magic Transit). Alert policies can be created via the Notifications tab in the Cloudflare dashboard. Alerts include a description, detection/mitigation time, attack type, max rate, and target, with links to view the attack in the dashboard and provide feedback.
  111. Raking the floods: my intern project using eBPFThis post details the development of an open-source framework, 'rakelimit', using eBPF socket filters to protect UDP services from floods. It introduces the concepts of Heavy Hitters and Hierarchical Heavy Hitters to identify attack traffic based on source/destination addresses and ports. The framework uses a fixed-point representation for rates in eBPF and a probabilistic approach (CountMin sketch) to manage memory efficiently. It implements a hierarchical structure to group related packets and a probabilistic passing mechanism to minimize impact on legitimate traffic. The framework is implemented as a Go library that can be attached to any UDP socket.
  112. Moobot vs. Gatebot: Cloudflare Automatically Blocks Botnet DDoS Attack Topping At 654 GbpsThis post details the automatic mitigation of a 654 Gbps UDP-based DDoS attack generated by the Moobot botnet. It highlights the roles of Gatebot, dosd, and flowtrackd in detecting and mitigating the attack, emphasizing the use of packet fields and HTTP request metadata for analysis. The post also discusses Cloudflare's global network capacity (over 42 Tbps), Anycast routing, and intra-data center load balancing with Unimog as key factors in absorbing such large-scale attacks without service degradation.
  113. Network-layer DDoS attack trends for Q2 2020This post details the Q2 2020 network-layer DDoS attack trends, noting a doubling of L3/4 attacks compared to Q1, an increase in the scale of the largest attacks, and more distributed attack vectors. It highlights that 63% of attacks peaking over 100 Gbps occurred in May, and 88% of all 2020 attacks peaking above 100 Gbps occurred after March. The post also details the 754 million pps attack in June and the geographical distribution of attacks, with the US being the most targeted. SYN floods constituted 57% of all L3/4 DDoS attacks.
  114. flowtrackd: DDoS Protection with Unidirectional TCP Flow TrackingIntroduces flowtrackd, a new software-defined DDoS protection system for Magic Transit that implements unidirectional TCP flow tracking. flowtrackd is a state machine that hooks into the network interface to track TCP connection states using only ingress traffic, enabling mitigation of complex TCP-based DDoS attacks like ACK floods that were previously challenging due to the lack of bidirectional visibility. It complements existing DDoS mitigation systems (Gatebot, dosd) and is deployed globally across Cloudflare's network.
  115. Mitigating a 754 Million PPS DDoS Attack AutomaticallyThis post details the automatic mitigation of a 754 million packets per second (Mpps) DDoS attack using Cloudflare's Gatebot and dosd systems. It explains the attack vectors (SYN floods, ACK floods, SYN-ACK floods) and differentiates between bit-intensive, packet-intensive, and request-intensive DDoS attacks. The post highlights the use of BGP Anycast for global traffic distribution, kernel-level packet dropping via Gatebot and dosd for efficiency, and the Unimog L4 load-balancer for intra-data center traffic management. It emphasizes the autonomous nature of the mitigation, with no human intervention required.
  116. Network-Layer DDoS Attack Trends for Q1 2020This post analyzes network-layer DDoS attack trends for Q1 2020, observing a shift towards smaller, shorter attacks (under 10 Gbps, < 1 million pps, 30-60 min duration), likely driven by DDoS-as-a-service. It notes that larger attacks still occur, with the largest observed peaking above 550 Gbps. Attacker persistence decreased compared to Q4 2019. SYN attacks were the most common vector (60.1%), followed by ACK (12.4%) and CLDAP (5.3%). The post highlights that the crisis period (COVID-19 lockdowns) saw an increase in DDoS attacks, particularly larger ones in the latter half of March. It concludes by reiterating Cloudflare's strengths in rapid mitigation (under 10 seconds), distributed architecture, and massive network capacity (over 35 Tbps) for handling evolving DDoS threats.
  117. DDoS attacks have evolved, and so should your DDoS protectionThis post details the evolution of DDoS attacks, noting the rise of smaller network-level attacks (<10 Gbps) and the continued prevalence of large volumetric attacks (300+ Gbps, with a 550 Gbps observed in March 2020). It also highlights an interesting application-level HTTP DDoS attack that peaked at 1.4M requests per second from 1.1M unique IPs. The post emphasizes Cloudflare's strengths in massive network capacity (35 Tbps), globally distributed architecture (200+ cities), fast mitigation (<10s), integrated security, and unmetered/unlimited mitigation.
  118. Rolling With The Punches: Shifting Attack Tactics & Dropping Packets Faster & Cheaper At The EdgeThis post details the evolution of Cloudflare's DDoS mitigation systems, introducing 'dosd' as a decentralized, edge-analyzed, edge-enforced mitigation system to complement the centralized Gatebot. dosd detects and mitigates smaller, localized attacks faster (0-3 seconds). It also introduces 'IP Jails' as a Gatebot capability that shifts L7 mitigations to L4 for extremely rate-intensive and distributed HTTP DDoS attacks, significantly reducing CPU, memory, and bandwidth costs by dropping connections at the transport layer instead of responding with L7 challenges. The post also discusses trends in L3/L4 and L7 DDoS attacks, noting a decline in the average rate of L3/L4 attacks but an increase in hyper-localized attacks, and a rise in rate-intensive L7 attacks.
  119. Announcing Network AnalyticsThis post introduces Network Analytics for Magic Transit and BYOIP customers, extending visibility from Layer 7 to Layer 3. It details the architecture for collecting and storing packet-level traffic data (IP flow logs) and attack summaries, enabling one year of historical insights. The post also describes the GraphQL API for accessing this data and outlines the key use cases for incident response and reporting, including specific metrics relevant to security and network engineers.
  120. Dogfooding Magic Transit by DDoSing our Austin officeThis post details the dogfooding of Cloudflare's Magic Transit service by intentionally launching DDoS attacks against the company's Austin office. It explains how Magic Transit routes traffic through Cloudflare's global network, where it is protected by multiple layers of defense including XDP, eBPF, and iptables. The post highlights the roles of Gatebot and the newly deployed DoSD (denial of service daemon) in dynamically generating and applying mitigation rules in near real-time. It provides practical examples of attack scenarios and their successful mitigation, demonstrating the effectiveness of the system in protecting networks without sacrificing performance. The dogfooding exercise also led to fine-tuning of mitigations and routing, as well as procedural improvements for onboarding and incident response.
  121. Cleaning up bad bots (and the climate)This post introduces a new 'bot fight mode' that enhances Cloudflare's DDoS mitigation capabilities. When a bad bot is detected, the system now employs three key actions: 1) economic disincentivization through tarpitting and computationally intensive challenges, 2) IP sharing with Bandwidth Alliance partners to get bots offline, and 3) carbon offsetting by planting trees to compensate for the increased CPU usage. The post also details how Cloudflare detects bots using its scale, machine learning models, handwritten rules, Bot Activity Detector, Trusted Client model, and Gatebot. It explains the cost of bot attacks and how Cloudflare aims to make running malicious bots non-viable.
  122. On the recent HTTP/2 DoS attacksThis post details Cloudflare's protection against several HTTP/2 specific Denial of Service (DoS) vulnerabilities (CVE-2019-9511 through CVE-2019-9518). Cloudflare's Protocols team developed and deployed mitigations for these vulnerabilities by patching NGINX, ensuring that customers using Cloudflare are protected. The post also advises customers hosting web services on alternative paths not behind Cloudflare to apply the latest security updates to their origin servers.
  123. L4Drop: XDP DDoS MitigationsIntroduced L4Drop, a new DDoS mitigation tool leveraging eXpress Data Path (XDP) and eBPF. Replaced the previous Floodgate kernel bypass approach due to NIC incompatibility. L4Drop compiles existing BPF rules into eBPF programs, enabling arbitrary packet data matching and eliminating the need for busy polling. Implemented a BPF to C compiler for seamless integration of existing BPF filters and developed a mechanism to modify ELF binaries for location-specific rule enablement. Demonstrated production deployment with high packet drop rates and minimal CPU impact.
  124. The rise of multivector DDoS attacksThis post details the evolution of DDoS attack vectors observed by Cloudflare, including a massive 942Gbps SYN flood attributed to Xor.DDoS malware, the decline of SSDP and memcached amplification attacks, and the rise of multivector amplification attacks combining various techniques. It provides data on attack volumes, source distributions, and specific amplification protocols used. The post highlights Cloudflare's ongoing efforts to mitigate these evolving threats.
  125. Cloudflare’s network boosts security and performance for IBM Cloud customersThis post announces the general availability of Cloudflare's Cloud Internet Services (CIS) Enterprise, a partnership with IBM Cloud. CIS Enterprise integrates Cloudflare's DDoS mitigation, WAF, smart routing, and load balancing into the IBM Cloud user interface. It highlights Cloudflare's network capacity (12x larger than the largest recorded DDoS attack, 10% of global HTTP requests) and its distributed architecture where each data center offers the full stack of services. This allows for mitigation close to the source and protection of complex applications. The Bandwidth Alliance is also mentioned, waiving data transfer fees between IBM and Cloudflare servers for CIS Enterprise customers.
  126. Today we mitigated 1.1.1.1This post details an incident where a misconfiguration in Cloudflare's Gatebot DDoS mitigation pipeline caused a 17-minute outage of the 1.1.1.1 DNS resolver. The issue arose from a new integration with the Provision API, which Gatebot used to identify Cloudflare IP addresses. A hardcoded exception for the 1.1.1.0/24 and 1.0.0.0/24 ranges, which was intended to be removed as technical debt, was not accounted for in the new integration. This led Gatebot to incorrectly interpret traffic to these special IP ranges as an attack and apply DNS mitigations, rendering the resolver inaccessible. The incident highlights a failure in thorough testing of changes to critical mitigation systems.
  127. The real cause of large DDoS - IP SpoofingThis post details the fundamental cause of large DDoS attacks: IP spoofing. It explains how IP spoofing enables both direct and amplification attacks by allowing attackers to forge source IP addresses. The post elaborates on why IP spoofing is possible due to the internet's design (multihoming, dynamic paths, routing asymmetry) and illustrates the difficulty of source IP filtering, even for directly connected networks. It introduces BCP38 as the recommended solution for last-mile ISPs and discusses how internet carriers can assist by cleaning up their networks and improving visibility into spoofed traffic. The post also includes visualizations of direct attack source IPs using Hilbert Curves and maps of abused servers in amplification attacks.
  128. Memcrashed - Major amplification attacks from UDP port 11211This post details a new amplification attack vector using the memcached protocol over UDP port 11211, which can achieve significant amplification factors (up to 51,200x) and has led to attacks reaching 260Gbps. It explains the mechanics of UDP amplification attacks, the specific vulnerability in memcached's protocol, and identifies common hosting providers and ASNs hosting vulnerable servers. The post provides guidance for memcached users to disable UDP support or restrict listening interfaces, for system administrators to firewall servers, and for ISPs to help track attack origins. It also includes a prologue noting prior discussion of memcached for DDoS and an update on service providers addressing the issue.
  129. Inside the infamous Mirai IoT Botnet: A Retrospective AnalysisThis post provides a retrospective analysis of the Mirai IoT botnet, detailing its genesis, propagation mechanisms (fixed default credentials), attack vectors (HTTP flooding, UDP flooding, TCP state-exhaustion), and its impact on high-profile targets like Krebs on Security, OVH, and Dyn. It also discusses the rise of copycat botnets and the techniques used to track them. While not detailing new mitigation techniques, it serves as a case study of a major DDoS threat that informs the ongoing evolution of Cloudflare's DDoS mitigation architecture.
  130. The New DDoS LandscapeThis post details the evolving landscape of DDoS attacks, noting a shift from volumetric Layer 3/4 attacks to more sophisticated application-layer attacks. It explains the mechanisms attackers use to gain capacity (botnets, IoT devices, DNS amplification) and contrasts older DDoS mitigation priorities (capacity, Anycast network) with the new reality. The post highlights the decreasing frequency of SYN Flood attacks and the continued prevalence of application-layer attacks, emphasizing Cloudflare's Unmetered Mitigation policy.
  131. No Scrubs: The Architecture That Made Unmetered Mitigation PossibleThis post details Cloudflare's architectural decision to forgo dedicated scrubbing centers for DDoS mitigation, instead integrating mitigation capabilities directly into its global network and server infrastructure. It highlights the problems with traditional scrubbing (bandwidth, cost, knowledge gap) and presents Cloudflare's alternative: leveraging commodity hardware, massive network capacity, Anycast routing, and intelligent packet handling (iptables, EFVI) across all servers. The post emphasizes how this approach leads to better cost-efficiency, lower latency, and continuous improvement of the entire software stack through real-world attack data.
  132. Meet Gatebot - a bot that allows us to sleepThis post introduces Gatebot, an automated system for DDoS mitigation. Gatebot operates in three parts: attack detection (using streaming algorithms in Golang), reactive automation (business logic in Python using a functional, reactive programming engine), and mitigation deployment. It automates the application of iptables rules and kernel bypass techniques (floodgate) for large attacks, and also handles HTTP layer mitigations like disabling Keep-Alives and enabling 'I'm under attack' mode. Gatebot has been engaged hundreds of times daily and its model has been reused for other systems like the Automatic Network System.
  133. Unmetered Mitigation: DDoS Protection Without LimitsIntroduced 'Unmetered Mitigation' for DDoS attacks, officially eliminating surge pricing and customer termination based on attack size. This policy applies to all plan levels (Free, Pro, Business, Enterprise). While higher-tier plans retain enhanced reporting and support, volumetric DDoS mitigation is now unlimited and unmetered. This move aims to set a new industry standard, similar to the company's earlier initiative to make encryption free by default.
  134. Hurricane IrmaThis post details how Cloudflare's Miami datacenter, classified as Tier IV, is designed to withstand catastrophic events like Hurricane Irma. It highlights the datacenter's redundant power and cooling systems, backup generators, and multiple internet connectivity routes. In the event of an outage, Anycast routing will reroute traffic to other US data centers. The post also mentions precautionary measures taken by data center facilities and their customers.
  135. The WireX Botnet: How Industry Collaboration Disrupted a DDoS AttackThis post details the collaborative effort between multiple organizations (Akamai, Cloudflare, Flashpoint, Google, Oracle Dyn, RiskIQ, Team Cymru) to disrupt the WireX botnet. It describes the botnet's characteristics, including its use of Android devices, HTTP GET requests, and distinctive User-Agent strings. The post highlights the importance of information sharing and collaboration in combating large-scale DDoS attacks, detailing how researchers traced the malware, identified malicious applications, and worked with app stores to remove them. It also provides technical details on the C2 infrastructure and the malware's operation.
  136. Stupidly Simple DDoS Protocol (SSDP) generates 100 Gbps DDoSThis post details a specific instance of a 100 Gbps+ Stupidly Simple DDoS Protocol (SSDP) amplification attack, analyzing its characteristics, the underlying protocol vulnerabilities (UPnP/SSDP's lack of network boundary checks and the 'ssdp:all' ST type's large response size), the role of IP spoofing, and the common server implementations involved. It provides statistics on reflector IPs, ASNs, and the amplification factors achieved. This analysis contributes to Cloudflare's understanding of emerging DDoS vectors and informs the continuous evolution of its DDoS mitigation architecture.
  137. Reflections on reflection (attacks)This post details the analysis of common reflection and amplification attacks, including NTP, SSDP, and IP fragmentation, and explains how Cloudflare's infrastructure automatically mitigates these threats by analyzing packet characteristics like source port and packet size, and by leveraging its global network to absorb and filter malicious traffic. It provides statistics on attack frequency, duration, bandwidth, and geographic distribution for NTP and SSDP attacks, and discusses the underlying mechanisms of reflection attacks and the importance of IP spoofing prevention.
  138. DDoS Ransom: An Offer You Can RefuseThis post details the modus operandi of a new DDoS ransom group, including their attack patterns (peaking around 10 Gbps, lasting less than an hour, using DNS amplification or NTP reflection), ransom email variations, and the use of demonstration attacks. It emphasizes that paying the ransom is discouraged as it perpetuates the activity and encourages future targeting. The post also provides guidance on building an action plan for DDoS protection in advance and encourages customers to reach out to Cloudflare for assistance during an attack.
  139. The Daily DDoS: Ten Days of Massive AttacksThis post details a ten-day period of massive, sustained L3/L4 TCP floods, peaking at 480Gbps and 172Mpps, which were automatically mitigated without customer impact. It highlights a new attack pattern of sustained, 'regular hours' attacks, distinct from previous weekend-focused patterns and not originating from the Mirai botnet. The attacks were highly concentrated geographically and targeted the TCP protocol.
  140. How Cloudflare's Architecture Allows Us to Scale to Stop the Largest AttacksThis post details Cloudflare's architectural approach to scaling DDoS mitigation, contrasting it with legacy 'scrubbing center' models. It emphasizes the use of commodity hardware, BGP for distributed load balancing within and across data centers, and the economic advantage of a high egress-to-ingress bandwidth ratio for absorbing attacks at minimal additional cost. The core idea is that every server in the network can contribute to mitigation, allowing for cost-effective scaling and near-source attack defense.
  141. Say Cheese: a snapshot of the massive DDoS attacks coming from IoT camerasThis post details the emergence of large-scale Layer 7 DDoS attacks originating from IoT botnets, exemplified by two distinct attack patterns: one characterized by over 1 million HTTP requests per second with short requests, and another by substantial bandwidth consumption (up to 360Gbps) due to long HTTP request payloads. It highlights the distribution of these attacks across Cloudflare's global network and identifies key Autonomous Systems (AS) and device types (CCTV cameras, NAS) involved. The post also notes the evolution of DDoS mitigation strategies to recognize and block these new L7 attack vectors.
  142. How the Consumer Product Safety Commission is (Inadvertently) Behind the Internet’s Largest DDoS AttacksThis post details how the Consumer Product Safety Commission's (CPSC) large DNS records are being inadvertently used as an amplification vector for DNS reflection DDoS attacks. It explains the mechanics of amplification attacks, specifically DNS reflection, and quantifies the CPSC's DNS record's popularity among attackers (94% of observed DNS reflection attack requests). The post analyzes the CPSC's zone file, identifying specific records contributing to its large size and suggesting optimizations to reduce it, thereby making it a less attractive target for amplification. It also touches upon DNSSEC and its role in the zone file.
  143. Introducing the p0f BPF compilerThis post introduces the open-sourcing of Cloudflare's p0f BPF compiler, a component of their bpftools. The compiler translates p0f SYN signatures into BPF bytecode, allowing iptables to efficiently discriminate and mitigate attack packets based on their signatures. The post details the p0f signature format, provides examples of its use in distinguishing legitimate traffic from attack traffic, and explains how to compile p0f signatures to BPF bytecode using the bpftools. It also includes an example of blocking hping3 generated SYN packets.
  144. 400Gbps: Winter of Whopping Weekend DDoS AttacksThis post details the scale of recent DDoS attacks, peaking at 400Gbps and 180Mpps, and how Cloudflare's infrastructure absorbed and automatically mitigated them. It highlights the importance of network capacity and automated mitigation systems in handling such large-scale attacks without resorting to blackholing. The post also notes that increased network capacity leads to the observation of larger attacks.
  145. Mobile Ad Networks as DDoS Vectors: A Case StudyThis post details a novel DDoS attack vector utilizing mobile ad networks to distribute malicious JavaScript, which then launched browser-based L7 floods against Cloudflare customers. The analysis covers the request structure, the attack page's obfuscated JavaScript, log analysis revealing the attack's origin (primarily China, mobile devices), and a speculative distribution vector via ad networks. Cloudflare's ability to handle these attacks automatically at the edge is highlighted.
  146. Kernel bypassThis post introduces and analyzes various kernel bypass techniques for high-speed packet processing, addressing the limitations of vanilla Linux networking for handling large packet floods. It details experiments demonstrating the performance drop of the Linux kernel stack with increasing CPU cores and explores Packet_mmap, PF_RING, Snabbswitch, DPDK, Netmap, Solarflare's EF_VI, bifurcated drivers, and virtualization approaches (VF interfaces) as solutions. The post highlights the challenges of dedicating entire NICs to bypass applications and the specific advantages of Solarflare's EF_VI and the bifurcated driver concept.
  147. An introduction to JavaScript-based DDoSThis post introduces JavaScript-based DDoS attacks as a new trend, where malicious JavaScript embedded in websites or compromised third-party scripts turns unwitting users into participants. It details how these Layer 7 attacks work, the risks of shared JavaScript compromise (e.g., jQuery.com), and the threat of man-in-the-middle attacks injecting malicious JavaScript. It also introduces Subresource Integrity (SRI) as a defense mechanism against compromised third-party assets and highlights HTTPS as a fundamental protection against man-in-the-middle attacks.
  148. DDoS Packet Forensics: Take me to the hex!This post details the forensic analysis of a DDoS attack against a Cloudflare DNS server, revealing a correlation between the TTL field in the IP header and the IPv4 source address. The author discovered that the source port is the first two bytes of the source IP reversed, the DNS ID is the one's complement of the first two bytes of the source IP, and the IPv4 header ID is the first two bytes of the IP address. The generation method of the random source IPs remains a mystery.
  149. Introducing the BPF ToolsThis post introduces Cloudflare's open-sourced BPF Tools, which include scripts for analyzing pcap files, parsing DNS traffic, generating BPF bytecode, and deploying it via iptables. The tools focus on filtering DNS traffic and mitigating stateless floods, specifically demonstrating how to drop packets targeting subdomains of a given domain using the `xt_bpf` iptables module. The post details the usage of `pcap2hex`, `parsedns`, `bpfgen`, `filter`, `iptables_bpf`, and `iptables_bpf_chain` for generating and verifying BPF rules to combat DDoS attacks.
  150. BPF - the forgotten bytecodeThis post details the historical context and technical implementation of the Berkeley Packet Filter (BPF) and its integration with iptables via the 'xt_bpf' module. It explains how BPF bytecode is generated from human-readable expressions, how it's attached to network interfaces, and its safety guarantees. The post highlights Cloudflare's use of custom BPF bytecode for sophisticated packet filtering and early traffic dropping to mitigate massive packet floods, providing examples of rules for matching specific DNS queries and subdomains, and demonstrating case-insensitive matching.
  151. What do you do when the world’s attention is on you?This post details the Texas Tribune's experience implementing Cloudflare to handle a 10x traffic spike for live-streamed interviews of Julian Assange and Edward Snowden. It highlights the immediate setup and testing of Cloudflare's DDoS protection and scaling capabilities in response to an urgent need, leading to a smooth experience with no downtime, lagging, or security problems during the events. The post also includes general security advice for web applications, such as implementing 2FA, enforcing strong passwords, closing unnecessary ports, and using static sites as a fallback.
  152. Good News: Vulnerable NTP Servers Closing DownThis post details the positive impact of community efforts in closing vulnerable NTP servers following a large DDoS attack. It highlights that over 75% of vulnerable servers involved in the attack were no longer vulnerable after a week and a half, indicating successful remediation by network administrators. It also references external data showing a significant decrease in NTP MONLIST amplifiers worldwide and specifically notes improvements from OVH in preventing NTP attacks from their server base.
  153. Technical Details Behind a 400Gbps NTP Amplification DDoS AttackThis post details a specific 400Gbps NTP amplification DDoS attack, explaining the mechanics of NTP amplification attacks using the MONLIST command, the scale of the attack (4,529 NTP servers), its global distribution, and the high amplification factor (206x). It contrasts this with DNS amplification attacks and highlights the effectiveness of fewer, more powerful NTP servers. The post also discusses the challenges of cleaning up the problem by working with network operators and emphasizes the importance of BCP38 to prevent source IP spoofing. It concludes by warning of future threats like SNMP amplification.
  154. Understanding and mitigating NTP-based DDoS attacksThis post details the mechanics of NTP-based DDoS amplification attacks, explaining how the `monlist` command can be exploited to generate large replies from small requests. It highlights the amplification factor (up to 206x) and the ease of finding vulnerable NTP servers. The post provides mitigation strategies for server administrators, including upgrading NTP servers to patched versions (e.g., 4.2.7p26) and implementing BCP-38 to prevent IP spoofing. Cloudflare's role in defending against these attacks is also mentioned.
  155. 2013: Rebuild the Engine; 2014: Step on the GasThis post details the upgrade of Cloudflare's per-server infrastructure from a 1Gbps platform to a 10Gbps platform in response to record-breaking DDoS attacks in 2013. It also mentions the rebuilding of the entire DNS infrastructure in Go and the standardization of Lua for processing HTTP requests.
  156. DDoS Prevention: Protecting The OriginThis post details how to protect the origin server's IP address from being revealed, which would allow attackers to bypass Cloudflare's DDoS protection. It provides specific recommendations such as keeping all subdomains on Cloudflare, removing wildcard subdomains for non-Enterprise plans, reviewing DNS records for IP mentions, avoiding hosting mail or other services on the same server as the web server, never initiating outbound connections based on user action, patching information disclosure vulnerabilities, and changing the origin IP after initial configuration.
  157. W3TC and WP Super Cache Vulnerability Discovered, We've Automatically PatchedThis post details Cloudflare's automatic patching of a remote code execution vulnerability affecting W3 Total Cache (versions 0.9.2.8 and below) and WP Super Cache (versions 1.2 and below). Cloudflare applied a network-level rule to block exploitation of the vulnerability, which involved functions like mfunc, mclude, and dynamic-cached-content, allowing attackers to execute arbitrary PHP code on vulnerable servers. The protection was automatically applied to all Cloudflare accounts, including free tiers. Users were still strongly advised to upgrade their plugins immediately.
  158. Patching the Internet in Realtime: Fixing the Current WordPress Brute Force AttackThis post details the real-time deployment of a Web Application Firewall (WAF) rule to mitigate a widespread WordPress brute-force attack targeting administrative portals. The rule detects the signature of the attack, which uses a botnet to attempt thousands of password combinations against the 'admin' username. Cloudflare automatically rolled out this protection to all customers, including free plan users, showcasing the platform's ability to "patch the Internet" in real-time.
  159. The DDoS that almost broke the InternetThis post details a massive 120Gbps DDoS attack against Spamhaus, highlighting the scale of the attack and its potential to overwhelm upstream Tier 1 providers and Internet Exchange Points (IXs). It explains how Cloudflare's Anycast network and peering relationships were crucial in mitigating the attack. The post also discusses the vulnerability of open DNS recursors being exploited for amplification attacks and the impact of the attack on Internet Exchange Points like LINX, AMS-IX, DE-CIX, and HKIX.
  160. The DDoS That Knocked Spamhaus Offline (And How We Mitigated It)This post details the mitigation of a large Layer 3 DDoS attack against Spamhaus, primarily using DNS reflection (specifically targeting ripe.net zone files) and ACK reflection. It explains how the attacker achieved a 100x amplification factor with DNS reflection and how Cloudflare's Anycast network architecture diluted the attack traffic across its global data centers. The post also touches on the role of open DNS resolvers as a major source of amplification attacks and the importance of BCP-38.
  161. Today's Outage Post MortemThis post details a system-wide failure of Cloudflare's edge routers caused by a bug in Juniper's Flowspec implementation. A rule intended to drop unusually large packets (99,971-99,985 bytes) due to a DDoS attack against a customer's DNS servers was incorrectly propagated by Flowspec. This rule caused all edge routers to consume all their RAM and crash. The incident led to a network-wide outage affecting all Cloudflare services. Incident response involved manually rebooting unresponsive routers and removing the faulty Flowspec rule. The post also discusses parallels to the Syrian Internet outage and outlines future plans for more extensive Flowspec testing and isolation of rule application.
  162. Good Web Security News: Open DNS Resolvers Are Getting ClosedThis post details the progress made in closing open DNS resolvers, which are a primary source of DDoS amplification attacks. It highlights that the number of open resolvers across the internet has decreased by over 30% since October 2012, with specific networks showing significant improvements. The post also acknowledges the efforts of organizations like Team Cymru and SoftLayer in this cleanup effort and offers to provide data to network providers interested in addressing open resolvers on their networks.
  163. When the Attackers Name Malware After You, You Know You're Doing Something RightThis post details the evolution of Cloudflare's "I'm Under Attack Mode" (IUAM) from a simple 2+2 math problem to a more complex, JavaScript-rendered challenge. It describes the discovery of malware ('OutFlare') specifically designed to bypass the original IUAM by reverse-engineering the simple math problem. In response, Cloudflare updated IUAM to obfuscate the equation and employ JavaScript rendering to make it harder to bypass. The post also outlines future plans for "proof of work" challenges, similar to Bitcoin, and emphasizes Cloudflare's advantage in real-time service updates for adapting to new threats.
  164. What Happens When a Hurricane Hits the WebThis post details Cloudflare's experience during Hurricane Sandy, focusing on the resilience of its infrastructure and the impact on the broader internet. It describes how Cloudflare's data centers, specifically EWR and IAD, maintained operations despite power outages and generator failures, leveraging redundant power systems. It also notes the failure of the Level(3) AC-2 undersea cable and the increased use of Cloudflare's 'Always Online' functionality due to origin server outages. The post observes that traffic to Cloudflare's data centers in the affected region dropped minimally, speculating that users with connectivity were more engaged online.
  165. Deep Inside a DNS Amplification DDoS AttackThis post details the analysis of a persistent 20Gbps DNS amplification DDoS attack against a Cloudflare customer. It explains how DNS amplification attacks work, the criteria for a good amplification vector (spoofed source address and large response), and the specific example of a tiny DNS query resulting in a large response (50x amplification). It also discusses the role of DNSSEC in exacerbating amplification and the importance of open DNS resolvers as a vulnerability. The post highlights Cloudflare's ability to absorb such attacks due to its distributed network and wholesale bandwidth purchasing model, allowing it to learn from sustained attacks without significant cost or customer impact.
  166. Post Mortem: What Yesterday's Network Outage Looked LikeThis post details a specific incident where a misapplied network rate limit, intended to mitigate a large DDoS attack, caused a widespread outage in Europe. It describes the two visible events: an upstream bandwidth provider issue and the misapplied rate limit. The post explains the technical details of the DDoS attack (layer 4, 65 Gbps) and the subsequent mistake in applying a rate limit, which impacted a wider customer base than intended due to concentrated traffic in Europe. It also mentions the need for additional smoke tests to prevent similar future incidents and highlights the importance of control plane resilience.
  167. Saturday Night Fever: Layer 7 attacks against CloudFlare sitesThis post analyzes Layer 7 DDoS attacks against Cloudflare sites, identifying Saturday as the peak day for attacks. It details the characteristics of these attacks, including their source traceability due to TCP connections, and presents statistical data on attack frequency, IP address origins, and temporal patterns. The analysis also notes a trend of attackers switching from lower-level DDoS attacks to Layer 7 attacks and identifies top attacking countries and networks. Cloudflare's automated systems and staff are highlighted for their role in defending against these attacks, alongside tools like 'I'm under attack mode'.
  168. Mars Attacks!This post analyzes the source of DDoS attacks in July 2012, identifying 'Martian IP addresses' (private and loopback addresses) as the largest source (23%) of attacks. It explains IP address spoofing and its use in reflection attacks, particularly DNS reflection, where small queries result in amplified larger replies. The post details how attackers exploit innocent DNS servers to flood Cloudflare with unwanted replies and how this amplification effect increases attack bandwidth. It concludes that source IP addresses are largely useless for identifying attackers in Layer 3/4 attacks.
  169. The Wednesday Witching Hour: CloudFlare DoS StatisticsThis post details the analysis of DDoS attack statistics observed on the Cloudflare network in 2012. It quantifies attack frequency by time of day and day of the week, identifying the 'Wednesday Witching Hour' as the peak. It breaks down attacks by IP protocol (TCP vs. UDP) and common ports (80 for TCP, 53 for UDP), noting the prevalence of UDP reflection attacks using DNS and SNMP, and SYN flooding for TCP. It also discusses the exacerbating effect of DNSSEC on some reflection attacks and the 'carpet bombing' technique. The post notes a slight downward trend in overall attacks over the past 6 months, attributing it to attackers shifting focus to application-layer attacks and the rise of short-duration 'booter' attacks.
  170. Thoughts on the AWS outage: making the cloud more resilient to failureThis post discusses the AWS outage of June 2012 and uses it as a springboard to explain Cloudflare's architectural approach to resilience. It differentiates between IaaS, PaaS, and SaaS, and argues that the 'Front End layer' of web applications is naturally suited for massive distributed scaling and can be moved to the cloud without the complex data synchronization challenges of the 'Data & Application layer'. Cloudflare's own architecture is presented as an example of a scalable front-end layer that can accelerate and protect web traffic without requiring application-level changes. The post highlights how hardware failures in a data center are handled gracefully by shifting traffic to the next closest data center due to the stateless nature of the front-end layer.
  171. Introducing: I'm Under Attack ModeIntroduced 'I'm Under Attack Mode,' a new security level for DDoS protection that adds an interstitial page for visitors to undergo automated checks before reaching the origin server. This mode requires JavaScript and cookies, is designed to not impact SEO or known legitimate visitors, and feeds attack data back into Cloudflare's system to improve existing protections.
  172. ScrapeShield: The scaled up, deep intelligence anti-scraping serviceThis post introduces ScrapeShield, a new anti-scraping service that builds upon Cloudflare's existing bot profiling and intelligence gathered over 8 years through Project Honeypot. ScrapeShield leverages this deep web intelligence and active anti-scraping features to detect and alert website owners about content scraping. It provides insights into how content is consumed off-web and benefits from Cloudflare's massive scale for continuous improvement.
  173. TODAY Show Traffic Spike No Problem For KhatalandThis post details how Cloudflare's platform was used to handle a significant traffic spike for Khataland.com during a TODAY Show promotion. It highlights the platform's ability to absorb bandwidth usage, protect against denial of service attacks, and maintain website availability during surges. The setup process is described as simple and quick, with positive testimonials from both the customer (Khataland) and their e-commerce platform provider (CoreCommerce). The post includes traffic graphs and resource savings data.
  174. Apache Killer Terminated: Zero Day Exploit, Zero Day FixImplemented a network-wide fix for the 'Apache Killer' zero-day exploit by filtering malformed or excessive byte-range headers before they reach origin servers. This protection was automatically applied to all Cloudflare users without requiring configuration changes.
  175. Breaking the Cycle of MalwareThis post introduces Cloudflare's approach to breaking the cycle of malware by identifying and notifying users with infected machines. It details how Cloudflare's security settings can challenge visitors with CAPTCHAs and how the company partners with anti-malware providers to offer cleanup tools. It also explains how compromised websites can be a distribution channel for malware and how Cloudflare protects against this.