Low-and-Slow DDoS Campaign Sent 2.45 Billion Requests From 1.2 Million IPs

A major user-generated content platform was hit by a highly distributed low-and-slow DDoS campaign that generated 2.45 billion malicious requests in five hours, peaking at 205,344 requests per second and averaging about 136,000 requests per second. According to DataDome’s Galileo threat research team, the operation relied on more than 1.2 million unique IP addresses spread across 16,402 ASNs, with no single network contributing more than 3% of the traffic. The attackers used a pulsed cadence and kept per-IP activity low—roughly one request every nine seconds on average—to stay below conventional rate-limiting thresholds and make simple IP blocking ineffective.

The traffic was designed to resemble legitimate users by rotating IPs, user agents, and payloads and by forging HTTP headers, cookies, and TLS fingerprints. Researchers said the botnet also blended traffic through anonymization-friendly providers and major cloud infrastructure including Cloudflare, AWS, and Google, complicating filtering efforts. DataDome reported that it detected and blocked the attack in real time using behavioral analysis, server-side fingerprinting, and threat intelligence, finding inconsistencies between claimed browser identities and actual TLS handshake behavior. The incident underscores how modern DDoS operators are shifting from brute-force floods to distributed evasion techniques that require time-based behavioral detection rather than static volume limits.