
According to an announcement from internet services provider Cloudflare, the company successfully mitigated a massive DDoS (Distributed Denial of Service) attack in May 2025, reaching an unprecedented peak of 7.3 Tbps. Remarkably, the attack caused no disruption to its clients’ services.
Statistics reveal that the attackers transmitted a staggering 37.4 TB of data in just 45 seconds—equivalent to downloading 9,350 full-length movies or streaming 7,480 hours of high-definition video without interruption.
In a sweeping assault across multiple ports, the attackers indiscriminately bombarded 21,925 ports—out of a possible 65,535—reaching a peak of 34,517 targeted ports per second. This brute-force strategy, commonly referred to as “carpet bombing,” seeks to expose hidden services by overwhelming all potential network entry points.
The attack traffic was dominated by UDP flood packets, comprising more than 99.996% of the total volume. The remainder—0.004%—consisted of other forms of reflection-based attacks, including QOTD, Echo, NTP, Mirai-driven UDP floods, Portmap floods, and RIPv1 amplification.
UDP flood attacks remain one of the most prevalent and effective techniques. By inundating a target IP address with massive quantities of UDP packets aimed at random or specific ports, threat actors attempt to saturate network connections or overwhelm server processing capacity, ultimately rendering the systems inoperative.
Although Cloudflare did not specify the source of the botnet, industry norms suggest the attack was orchestrated using a vast army of compromised devices. The offensive leveraged over 45,097 unique IP addresses, with the bulk of traffic originating from Brazil and Vietnam.
Upon detecting the attack, Cloudflare’s automated DDoS protection mechanisms were instantly triggered. Mitigation protocols were executed seamlessly without human intervention, ensuring uninterrupted service for all affected websites and platforms.