Cloudflare says it has stopped the largest DDoS attack (distributed denial of service attack) ever recorded. The attack peaked at 22.2 terabits per second and 10.6 billion packets per second. It was detected and mitigated automatically by Cloudflare’s network.
The company reported that the event lasted only 40 seconds but was still twice the size of anything previously seen on the internet. However, in the first week of September 2025, the company stopped a DDoS attack that reached 11.5 terabits per second and lasted about 35 seconds.
DDoS attacks work by overwhelming websites or services with massive amounts of traffic. In this case, the scale was so high that many providers without automated DDoS protection would not have been able to stay online.
Cloudflare has not shared details on the target of the attack, but in a tweet, it pointed out that its systems handled the surge without disruption. The announcement shows how attackers continue to test new levels of volume in their attempts to take services offline.
Massive DDoS incidents are becoming more common, and providers need the capacity to block them in real time. Organisations and users also need to rely on proper DDoS mitigation services to reduce the risk of becoming the next target.
