The Biggest DDoS Attacks in History: Records That Broke the Internet

Every few years a DDoS attack comes along that resets what "big" means. These are the record-breakers in the history of DDoS attacks - the incidents that knocked out household names, redefined the threat, and quietly changed how the whole internet defends itself.

2016 - Mirai and the day Twitter went dark

In October 2016 a botnet called Mirai aimed an enormous flood at Dyn, a major DNS provider. Because so much of the internet relied on Dyn, the collateral damage was staggering: Twitter, Reddit, Spotify, Netflix and others became unreachable for users across the US and Europe. The weapon was not a supercomputer - it was an army of hacked home routers and IP cameras. It was the moment the world learned that the Internet of Things could be turned into a wrecking ball.

2018 - GitHub and the Memcached record

In February 2018 GitHub was hit by what was then the largest recorded attack: roughly 1.35 Tbps. The technique was Memcached amplification - abusing thousands of misconfigured database-cache servers to multiply the attacker's traffic by a factor of tens of thousands. GitHub survived by routing through a scrubbing provider within minutes, and the internet scrambled to lock down exposed Memcached servers.

2020 - the 2.3 Tbps wake-up call

In 2020 a major cloud provider reported absorbing a 2.3 Tbps attack - at the time the biggest publicly disclosed. It used CLDAP reflection, another amplification trick. The headline number mattered less than the message: multi-terabit attacks were no longer theoretical, and even the largest networks had to plan for them.

2023 - Rapid Reset and the requests-per-second record

Not every record is about raw bandwidth. In 2023, a flaw in the HTTP/2 protocol - nicknamed Rapid Reset - let attackers generate floods measured in requests per second instead of bits. Several internet giants reported Layer-7 attacks in the hundreds of millions of requests per second, orders of magnitude above anything seen before. It was a reminder that application-layer attacks can be just as dangerous as volumetric ones.

2025-2026 - terabit attacks become routine

The most recent era is defined less by a single record than by how normal giant attacks have become. IoT botnets such as AISURU have pushed multi-terabit floods into everyday territory, with new highs reported repeatedly. What used to be a once-a-year, headline event is now background noise that filtering networks absorb continuously. For the wider pattern, see our 2025-2026 DDoS trends.

Every record-breaking attack has the same moral: the targets that stayed online were the ones already sitting behind enough capacity to absorb the hit.

What the records have in common

Look across all of them and a pattern emerges:

• The biggest attacks are powered by botnets of ordinary, insecure devices.
• Amplification lets a small attacker borrow enormous bandwidth.
• The survivors did not block the attack themselves - they had it absorbed upstream.
• Each record falls within a few years, so "big enough" is always a moving target.

How the record-breakers were actually stopped

None of these attacks were beaten by a single server fighting back - they were absorbed by scrubbing networks with far more capacity than the flood itself, filtering out the bad traffic and forwarding only the clean requests. That is the same principle, just at a smaller and more affordable scale, behind protecting a game or voice server: capacity and filtering upstream, not brute force on the box.

Why it matters for a game server

You will probably never be targeted by a record-breaker - but you do not need to be. A tiny slice of any of these botnets, rented for a few euros, is more than enough to flatten an unprotected game or voice server. The defence is the same one the giants use, just scaled to you: host behind a network that absorbs and filters the flood before it lands. That is how our protection works.