Record DDoS attack with 25.3 billion requests used HTTP/2 multiplexing

  • Thread starter Security feed from CyberSecurity Help
  • Start date

Security feed from CyberSecurity Help


Cybersecurity company Imperva said it stopped a distributed denial-of-service (DDoS) attack with a total of over 25.3 billion requests on June 27, 2022.

The attack targeted an unnamed Chinese telecommunications company and lasted over four hours, which is notable, as only 10.5% of attacks last between one and six hours, and most last under fifteen minutes.

“Attackers used HTTP/2 multiplexing, or combining multiple packets into one, to send multiple requests at once over individual connections. This technique can bring servers down using a limited number of resources, and such attacks are extremely difficult to detect. Since our automated mitigation solution is guaranteed to block DDoS in under three seconds, we estimate that the attack could have reached a much greater rate than our tracked peak of 3.9 million RPS,” the company explained.

The DDoS attack came from a massive botnet that comprised nearly 170,000 IP addresses including routers, security cameras and compromised servers located in over 180 countries, with most of them based in the US, Indonesia, and Brazil.

The news comes after Akamai revealed that it mitigated a record-breaking distributed denial-of-service (DDoS) attacks on September 12 aimed at one of its customers in Eastern Europe. The attacks reached unprecedented levels when the “garbage” traffic sent to the target network peaked at 704.8 Mpps, nearly 7% higher than the previous record-setting DDoS attack recorded in July 2022 (659.6 Mpps).

Adblock test (Why?)