Famous DDoS Attacks | The Largest DDoS Attacks Of All Time

In a distributed denial-of-service attack (DDoS), multiple devices are used to overwhelm a target server with requests and take web applications offline. Some of the biggest DDoS attacks have made major tech headlines.

Share
Common DDoS Attacks
DDoS Attack Tools
DDoS Glossary of Terms

Famous DDoS Attacks

Learning Objectives

After reading this article you will be able to:

  • Describe the magnitude of the most powerful DDoS attacks
  • Understand the motives behind some of the most infamous cyber attacks

What was the largest* DDoS attack of all time?

The biggest DDoS attack to date took place in February of 2018. This attack targeted GitHub, a popular online code management service used by millions of developers. At its peak, this attack saw incoming traffic at a rate of 1.3 terabytes per second (Tbps), sending packets at a rate of 126.9 million per second.


This was a memcached DDoS attack, so there were no botnets involved. Instead the attackers leveraged the amplification effect of a popular database caching system known as memcached. By flooding memcached servers with spoofed requests, the attackers were able to amplify their attack by a magnitude of about 50,000x!


Luckily, GitHub was using a DDoS protection service, which was automatically alerted within 10 minutes of the start of the attack. This alert triggered the process of mitigation and GitHub was able to stop the attack quickly. The world’s largest DDoS attack only ended up lasting about 20 minutes.


*It should also be noted that there was an alleged 1.7tbps DDoS attack 5 days after the attack on GitHub. However the victim of this attack was never publicly disclosed and there was not very much information released about it, making it difficult to verify.

What are some other famous DDoS attacks?

The 2016 Dyn attack

The second biggest DDoS attack was directed at Dyn, a major DNS provider, in October of 2016. This attack was devastating and created disruption for many major sites, including AirBnB, Netflix, PayPal, Visa, Amazon, The New York TImes, Reddit, and GitHub. This was done using a malware called Mirai. Mirai creates a botnet out of compromised Internet of Things (IoT) devices such as cameras, smart TVs, radios, printers, and even baby monitors. To create the attack traffic, these compromised devices are all programmed to send requests to a single victim.


Fortunately Dyn was able to resolve the attack within one day, but the motive for the attack was never discovered. Hacktivist groups claimed responsibility for the attack as a response to WikiLeaks founder Julian Assange being denied internet access in Ecuador, but there was no proof to back up this claim. There are also suspicions that the attack was carried out by a disgruntled gamer.

The 2015 GitHub attack

The largest DDoS attack ever at the time, this one also happened to target GitHub. This politically motivated attack lasted several days and adapted itself around implemented DDoS mitigation strategies. The DDoS traffic originated in China and it is strongly suspected that the Chinese Government oversaw the attack.


This DDoS attack specifically targeted the urls of two GitHub projects aimed at circumventing Chinese state censorship. It is speculated that the intent of the attack was to try and pressure GitHub into eliminating those projects.


The attack traffic was created by injecting JavaScript code into the browsers of everyone who visited Baidu, China’s most popular search engine. Other sites who were using Baidu’s analytics services were also injecting the malicious code; this code was causing the infected browsers to send HTTP requests to the targeted GitHub pages. In the aftermath of the attack it was determined that the malicious code was not originating from Baidu, but rather being added by an intermediary service. China has a policy of monitoring incoming traffic with their ‘Great Firewall’, it may also be the case that they modified the outbound packets with a similar intermediary process.

The 2013 Spamhaus attack

Another largest-ever-at-the-time attack was the 2013 attack launched on Spamhaus, an organization that helps combat spam emails and spam-related activity. Spamhous is responsible for the filtering as much as 80% of all spam, which makes them a popular target to people who would like to see spam emails reach their intended recipients.


The attack drove traffic to Spamhous at a rate of 300 gbps. Once the attack began, Spamhous signed up for Cloudflare. Cloudflare’s DDoS protection mitigated the attack. The attackers responded to this by going after certain internet exchanges and bandwidth providers in an attempt to bring down Cloudflare. This attack did not achieve its goal, it did however cause major issues for LINX, the London internet exchange. The main culprit of the attack turned out to be a teenage hacker-for-hire in Britain who was paid to launch this DDoS attack.


Read more about this attack and how it was mitigated on the Cloudflare blog.

The 2000 Mafiaboy attack

In 2000 a 15-year-old hacker known as ‘Mafiaboy’ took down several major websites including CNN, Dell, E-Trade, eBay, and Yahoo, which at the time was the most popular search engine in the world. This attack had devastating consequences including creating chaos in the stock market.


Mafiaboy, who was later revealed to be a high schooler named Michael Calce, coordinated the attack by hacking into the networks of several universities and leveraging their servers to conduct the DDoS attack. The aftermath of this attack directly led to the creation of many of today’s cybercrime laws.

The 2007 Estonia attack

In April 2007 the nation of Estonia was hit with a massive DDoS attack targeted at government services as well as financial institutions and media outlets. This had a crushing effect since Estonia’s government was an early adopter of online government and was practically paperless at the time; even national elections were conducted online


The attack, considered by many to be the first act of cyber warfare, came in response to a political conflict with Russia over the relocation of the ‘Bronze Soldier of Tallinn’, a World War II monument. The Russian government is suspected of involvement and an Estonian national from Russia was arrested as the result, but the Russian government has not let Estonian law enforcement do any further investigation in Russia. This ordeal led to the creation of international laws for cyber warfare.