In a major demonstration of cyber resilience, Cloudflare successfully blocked a record-breaking 7.3 Tbps DDoS (Distributed Denial-of-Service) attack in mid-May 2025. The attack, targeting a Cloudflare customer—a global hosting provider using Magic Transit—was one of the largest and fastest attacks ever recorded.
In just 45 seconds, the attack unleashed 37.4 terabytes of malicious data, equivalent to streaming thousands of HD movies or downloading millions of songs. The attack aimed to overwhelm the customer’s systems by targeting over 21,000 destination ports per second at its peak and using over 122,000 source IP addresses across 161 countries, with Brazil and Vietnam contributing nearly half of the traffic.
What made this attack particularly dangerous was its speed, complexity, and technique. Exploiting a vulnerability in the HTTP/2 web protocol, the attacker attempted to send over 200 million requests per second, aiming to cripple infrastructure quickly. It was a multi-vector attack, made up mostly of UDP floods, along with lesser-known attack types like NTP and Echo reflection, QOTD floods, and Mirai botnet activity.
Remarkably, Cloudflare’s systems detected and blocked the entire attack autonomously, without any human intervention or service disruption. This seamless defense highlights the strength of Cloudflare’s AI-driven, globally distributed protection network, now spanning more than 300 cities worldwide.
To help other providers protect themselves, Cloudflare offers a free Botnet Threat Feed, listing attacking IP addresses to help block future threats. Over 600 organizations have already subscribed.
As cyberattacks become more frequent and sophisticated, Cloudflare continues to innovate, building tools and intelligence to protect the digital world. This incident reinforces its commitment to a safer, more secure Internet—always on, always learning, and always prepared for the next threat.
