Cloudflare on Monday said it blocked the largest distributed denial-of-service (DDoS) attack ever recorded, at 11.5 Tbps (Terabits per second).
In a short message on X, Cloudflare only shared that the attack was a UDP flood mainly sourced from Google Cloud infrastructure, which lasted approximately 35 seconds.
“Cloudflare’s defenses have been working overtime. Over the past few weeks, we’ve autonomously blocked hundreds of hyper-volumetric DDoS attacks, with the largest reaching peaks of 5.1 Bpps and 11.5 Tbps. The 11.5 Tbps attack was a UDP flood that mainly came from Google Cloud,” the company said.
In a Tuesday update, Cloudflare said that Google Cloud was one source of attack, but not the majority, and that several IoT and cloud providers were used to launch the assault.
“Defending against this class of attack is an ongoing priority for us, and we’ve deployed numerous strong defenses to keep users safe, including robust DDoS detection and mitigation capabilities,” a Google Cloud spokesperson told SecurityWeek.
“Our abuse defenses detected the attack, and we followed proper protocol in customer notification and response. Initial reports suggesting that the majority of traffic came from Google Cloud are not accurate,” the spokesperson said.
A UDP flood attack consists of a high volume of UDP (User Datagram Protocol) packets being sent to a target, which becomes overwhelmed and unresponsive when attempting to process and respond to them.
Because UDP packets are small and the receiver spends resources trying to process them, the attackers also increased the packet rate to 5.1 Bpps (billion packets per second) to deplete those resources and take down the target.
This record-setting DDoS attack takes the lead as the largest in history roughly three months after Cloudflare blocked a 7.3 Tbps DDoS attack.
Seen in mid-May, the assault targeted a hosting provider and lasted for only 45 seconds. Approximately 37.4 Tb of traffic, or the equivalent of over 9,000 HD movies, was delivered in the timeframe.
The same as the newly observed attack, the May DDoS assault mainly consisted of UDP floods. It originated from over 122,000 IP addresses.
Cloudflare mitigated 27.8 million DDoS attacks in the first half of 2025, a number that surpassed the total observed in 2024 (21.3 million HTTP and Layer 3/4 DDoS attacks).
*Updated with statement from Google Cloud.
Related: Arch Linux Project Responding to Week-Long DDoS Attack
Related: ‘MadeYouReset’ HTTP2 Vulnerability Enables Massive DDoS Attacks
Related: Cloudflare Puts a Default Block on AI Web Scraping
Related:Europol Announces More DDoS Service Takedowns, Arrests
