The Biggest DDoS Attacks in History: Records That Broke the Internet

Every few years a DDoS attack comes along that resets what "big" means. These are the record-breakers — the attacks that knocked out household names, redefined the threat, and quietly changed how the whole internet defends itself.

2016 — Mirai and the day Twitter went dark

In October 2016 a botnet called Mirai aimed an enormous flood at Dyn, a major DNS provider. Because so much of the internet relied on Dyn, the collateral damage was staggering: Twitter, Reddit, Spotify, Netflix and others became unreachable for users across the US and Europe. The weapon was not a supercomputer — it was an army of hacked home routers and IP cameras. It was the moment the world learned that the Internet of Things could be turned into a wrecking ball.

2018 — GitHub and the Memcached record

In February 2018 GitHub was hit by what was then the largest recorded attack: roughly 1.35 Tbps. The technique was Memcached amplification — abusing thousands of misconfigured database-cache servers to multiply the attacker's traffic by a factor of tens of thousands. GitHub survived by routing through a scrubbing provider within minutes, and the internet scrambled to lock down exposed Memcached servers.

2020 — the 2.3 Tbps wake-up call

In 2020 a major cloud provider reported absorbing a 2.3 Tbps attack — at the time the biggest publicly disclosed. It used CLDAP reflection, another amplification trick. The headline number mattered less than the message: multi-terabit attacks were no longer theoretical, and even the largest networks had to plan for them.

2023 — Rapid Reset and the requests-per-second record

Not every record is about raw bandwidth. In 2023, a flaw in the HTTP/2 protocol — nicknamed Rapid Reset — let attackers generate floods measured in requests per second instead of bits. Several internet giants reported Layer-7 attacks in the hundreds of millions of requests per second, orders of magnitude above anything seen before. It was a reminder that application-layer attacks can be just as dangerous as volumetric ones.

2025–2026 — terabit attacks become routine

The most recent era is defined less by a single record than by how normal giant attacks have become. IoT botnets such as AISURU have pushed multi-terabit floods into everyday territory, with new highs reported repeatedly. What used to be a once-a-year, headline event is now background noise that filtering networks absorb continuously. For the wider pattern, see our 2025–2026 DDoS trends.

Every record-breaking attack has the same moral: the targets that stayed online were the ones already sitting behind enough capacity to absorb the hit.

What the records have in common

Look across all of them and a pattern emerges:

• The biggest attacks are powered by botnets of ordinary, insecure devices.
• Amplification lets a small attacker borrow enormous bandwidth.
• The survivors did not block the attack themselves — they had it absorbed upstream.
• Each record falls within a few years, so "big enough" is always a moving target.

Why it matters for a game server

You will probably never be targeted by a record-breaker — but you do not need to be. A tiny slice of any of these botnets, rented for a few dollars, is more than enough to flatten an unprotected game or voice server. The defence is the same one the giants use, just scaled to you: host behind a network that absorbs and filters the flood before it lands. That is how our protection works.