Published on: September 8, 2025
Cloudflare has disclosed that it automatically blocked a record-setting distributed denial-of-service (DDoS) attack that reached 11.5 terabits per second (Tbps). The 35-second incident, described as a UDP flood, is the largest volumetric assault the company has seen to date.
“Cloudflare’s defenses have been working overtime,” the company said in a post on X. “Over the past few weeks, we’ve autonomously blocked hundreds of hyper-volumetric DDoS attacks, with the largest reaching peaks of 5.1 Bpps and 11.5 Tbps.”
The attack was initially reported as primarily coming from Google Cloud, but Cloudflare later clarified that the surge originated from a mix of several IoT and cloud providers. In response, Google said, “Initial reports suggesting that the majority of traffic came from Google Cloud are not accurate,” adding that its abuse defenses detected the attack and the company followed protocol in responding.
Volumetric DDoS attacks are designed to overwhelm network infrastructure by flooding it with traffic until services slow down or fail. Akamai explains that “volumetric cyberattacks are believed to comprise more than 75% of DDoS attacks,” with attackers often using botnets of compromised devices to amplify traffic.
The scale of these assaults has risen rapidly. In mid-May 2025, Cloudflare stopped a 7.3 Tbps attack that lasted 45 seconds, and in its Q2 report, the company noted a surge of more than 6,500 hyper-volumetric incidents compared to just 700 the previous quarter.
Researchers warn that the size of an attack is not the only factor. “An 11.5 terabit flood sounds dramatic, but its short 35-second duration shows why size alone is the wrong metric,” said William Manzione of RETN. He emphasized that the real measure of resilience is whether web pages, APIs, and services stayed online while defenses absorbed the blow.