The graph below (Figure 1) represents the bot traffic handled over the course of the 12-hour attack by our detection engine, in 30 minute intervals. The attack reached a peak of 86 million requests per 30 minutes and ~55K requests per second towards the beginning of the attack.

The attack was distributed across ~311K IP addresses. The graph below (Figure 2) represents the distinct number of bot IP addresses during the attack.

We can see that at any given time, the attacker had access to between 120K and 140K distinct IP addresses to distribute their attack.

While the attacker leveraged mostly residential IPs belonging to well-known ISPs such as Charter Communications, Time Warner Cable, and Turk Telekom, there were some commonalities between requests:

Thanks to our multi-layered detection approach, the attack was blocked using different independent categories of signals. Thus, had the attacker changed part of its bot (for example, fingerprint or behavior), it would have likely been caught using other signals and approaches.

The main signals and detection approaches here were the following:

DDoS attacks are the bane of most businesses that operate online; they are usually highly publicized and have instant negative impacts on revenue, brand reputation, and customer experience.

DataDome's powerful multi-layered ML detection engine looks at as many signals as possible, from fingerprints to reputation, to detect even the most sophisticated boots. Keeping up with bots evolving fingerprints, such as proxy usage, is key to fighting today's main threats -- and DataDome can handle it.

When our system detects a DDoS attack in progress, our anti-DDoS mechanisms enable protection to scale perfectly, no matter the number of requests the attacker sends. To get a better look at how DataDome stops DDoS attacks, schedule a demo today.