Cloudflare Detected and Blocked 15.3Mln Requests Per Second DDoS Attack

[engine]

Cloudflare has reported it detected and blocked a DDoS attack of 15.3 million requests per second over HTTPS.

What’s interesting is that the attack mostly came from data centers. We’re seeing a big move from residential network Internet Service Providers (ISPs) to cloud compute ISPs.

This attack was launched from a botnet of approximately 6,000 unique bots. It originated from 112 countries around the world. Almost 15% of the attack traffic originated from Indonesia, followed by Russia, Brazil, India, Colombia, and the United States.

[blog.cloudflare.com...]

[martinibuster]

What's of particular interest is that the origins of the botnet are OVH and Hetzner.

[searchenginejournal.com...]

[lucy24]

Interesting, possibly. Surprising, not even slightly.

(But holy ###, engine, I thought you were reporting a 15.3mln attack on your individual site. Ouch.)

[phranque]

it's probably not a coincidence that one of our members reported IP addresses used by OVH [webmasterworld.com] and Hetzner [webmasterworld.com] hosted bots and scrapers the same day cloudflare published this blog post.

CF also mentions Azteca and Telkomnet as top networks originating the attack.
while OVH and Hetzner are well known here, i couldn't find any previous mentions of Azteca and Telkomnet on WebmasterWorld.

[brotherhood of LAN]

Had noticed some routing issues between OVH and Maidstone, UK last night, IIRC there was an AWS hop in between.

OVH/Hetzner are not surprisingly a source of bad traffic because they offer some of the cheapest dedi's in Europe.

[lucy24]

OVH/Hetzner are not surprisingly a source of bad traffic because they offer some of the cheapest dedi's in Europe.

And, conversely, it seems safe to assume one reason they're cheap is that they don't bother with making and enforcing user rules.