A website is humming along, serving pages to visitors, when suddenly it goes dark. Not because it was hacked — no data was stolen — but because it was buried. Somewhere on the internet, tens of thousands of hijacked devices are hammering it with junk traffic, and legitimate visitors can’t get through. This is a DDoS attack, one of the internet’s oldest and most stubbornly effective weapons.

What a DDoS attack actually is

DDoS stands for Distributed Denial of Service. The “denial of service” part is the goal: to make an online service unavailable. The “distributed” part is the method: the flood of traffic comes from many sources at once, not a single machine.

Every server has limits — it can only process so many requests per second, and its network connection can only carry so much data. A DDoS attack deliberately exceeds those limits. Imagine a shop with one entrance: a hundred customers walk in fine, but if ten thousand people crowd the doorway at once, nobody gets in. The shop is still intact; it is simply unreachable. Websites, game servers, banks, and government portals fall to this principle.

Because the attack traffic comes from thousands of devices across many countries, it is extremely difficult to block by banning a few addresses — and hard to tell malicious requests apart from real ones.

The three main types of DDoS attacks

Security specialists usually divide DDoS attacks into three families, matching the layers of the network stack they target:

• Volumetric attacks are the most common. They flood the victim’s bandwidth with enormous quantities of traffic — UDP floods, ICMP floods, and similar — until the pipes are full and nothing else fits.
• Protocol attacks exploit weaknesses in how servers handle connections. The classic example is the SYN flood: the attacker sends a barrage of TCP connection requests with fake return addresses, so the server keeps resources reserved for connections that never complete.
• Application-layer attacks are the subtlest. Instead of brute-force volume, they send legitimate-looking requests to the part of the server that generates web pages — an HTTP flood can look like thousands of users repeatedly hitting refresh, making them among the hardest to detect.

Botnets: the armies behind the attacks

One laptop cannot flood a major website. A million devices can. Attackers assemble these armies through botnets — networks of internet-connected devices infected with malware and controlled remotely through a command-and-control server, usually without the owners knowing. They can range from thousands to millions of devices: PCs, servers, phones, and increasingly the “internet of things.” The most famous example is Mirai, malware that spread in 2016 by logging into security cameras and routers with factory-default passwords. On 21 October 2016, Mirai was turned against Dyn, a major DNS provider — the internet’s phone book. Rather than attacking websites directly, the botnet destroyed the signposts pointing to them, and Twitter, Netflix, Reddit, and GitHub went dark for hours.

The records have kept falling since. Cloudflare reported that a Mirai-variant botnet generated a 5.6-terabit-per-second UDP attack — the largest on record — using just over 13,000 compromised IoT devices, lasting only 80 seconds.

Floods, reflection and amplification

Attackers have tricks to get more damage per device. One of the most powerful is amplification: the attacker sends a small request to a public server (such as a DNS or NTP server) with the victim’s address forged as the return address, and the server replies with a far larger response — sent to the victim. In the memcached amplification attacks of 2018, a tiny spoofed packet could trick an exposed server into returning up to 50,000 times more data. Because the replies come from legitimate servers and use connectionless protocols like UDP that never verify the sender, this traffic is especially hard to defend against.

DDoS-for-hire: attacks anyone can buy

You no longer need a botnet of your own to launch an attack. So-called booter and stresser services rent out DDoS attacks for a fee, lowering the barrier so far that anyone with a grudge and a payment method can take a site offline. Law enforcement has repeatedly targeted these marketplaces — most recently, in September 2026, the FBI seized the domains of NightmareStresser in a coordinated international operation after investigators linked the service to hundreds of thousands of attacks since 2022.

Motives vary: extortion (pay up or stay offline), eliminating competitors, political protest, gaming grudges, sometimes just showing off. Launching such attacks is illegal in most jurisdictions — in the United States they can be prosecuted under the Computer Fraud and Abuse Act, with penalties of up to ten years in prison.

How defenders fight back

There is no single fix, so defense is layered. The first principle is capacity: you cannot absorb a flood without a bigger pipe than the attacker can fill. Content delivery networks (CDNs) such as Cloudflare and Akamai spread traffic across global nodes so no single location takes the full hit, and anycast routing lets the same address be served from many places, splitting an attack across sites by design. Traffic is also filtered — “scrubbed” — in real time before it reaches the real servers.

Additional tools include rate limiting (capping how many requests one source can make), web application firewalls, traffic monitoring that spots abnormal spikes early, and dedicated mitigation platforms such as AWS Shield, Google Cloud Armor, and Azure DDoS Protection.

The fight is never truly over. Attack volumes keep growing as more insecure devices join the internet, and defenders keep building bigger shields. Understanding how the attacks work is the first step toward taking them seriously.

FAQs

What is the difference between a DoS and a DDoS attack?
A DoS attack comes from a single source; a DDoS comes from many sources at once — typically a botnet. The distributed version is far harder to block and can generate vastly more traffic.

Does a DDoS attack steal data?
Not directly — it is about availability, not theft. It overwhelms a service so legitimate users cannot reach it, though attackers sometimes use one as a smokescreen while a different intrusion happens.

What was the largest DDoS attack ever recorded?
Cloudflare reported a 5.6-terabit-per-second UDP attack from a Mirai-variant botnet of just over 13,000 IoT devices. Before that, the 2016 Mirai attack on DNS provider Dyn — estimated at over a terabit per second — held the record and knocked major sites offline for hours.

Can small businesses defend against DDoS attacks?
Largely yes, by using a CDN with built-in DDoS protection, keeping software updated, hiding the origin server’s real address, and having a response plan. Volumetric defense is mostly a provider-level problem, so choosing the right provider matters more than buying hardware.

Is it illegal to launch a DDoS attack?
Yes, in most jurisdictions. In the United States, DDoS attacks can be prosecuted under the Computer Fraud and Abuse Act with penalties of up to ten years in prison, and law enforcement agencies periodically seize DDoS-for-hire services.

Compiled by the Khabar 24h Editorial Desk from publicly available sources.