DataDome Thwarts Massive 2.45-Billion-Request DDoS Attack Targeting User-Generated Content Platform In mid-April 2026, a major user-generated content platform faced one of the most sophisticated DDoS attacks ever documented. Over five hours, attackers flooded the platform with 2.45 billion malicious requests, peaking at 205,000 requests per second and maintaining an average of 136,000 requests per second. The assault was orchestrated by a botnet of 1.2 million unique IP addresses, making it nearly undetectable to traditional defense systems. The attack’s stealth lay in its distribution: instead of overwhelming the platform from a few high-volume sources, it spread requests across 1.2 million IPs, each sending just one request every nine seconds a rate low enough to evade standard rate-limiting defenses. The botnet leveraged 16,402 autonomous systems worldwide, with no single network accounting for more than 3% of the total traffic, ensuring no targeted blocking could disrupt the attack. Some IPs originated from anonymization-friendly providers like 1337 Services GmbH and the Church of Cyberology, while others blended into legitimate traffic from Cloudflare, Amazon, and Google infrastructures. DataDome’s Galileo team detected the attack by analyzing behavioral patterns rather than raw traffic volume. Key red flags included: - Technical inconsistencies in browser fingerprints (e.g., mismatched headers, cookies, or URL parameters). - Mechanical navigation sequences too precise to be human. - Adaptive attack waves, with pauses to reset detection counters, suggesting human or AI-driven orchestration rather than a simple script. The attackers attempted to mimic legitimate users by spoofing browser data and rotating IPs, but their efforts left contradictory traces that advanced analytics could identify. The platform’s reliance on user-generated content and its systemic interconnectedness made it a prime target disrupting it could trigger cascading failures, creating opportunities for ransom demands or secondary attacks. This incident underscores the evolving sophistication of DDoS campaigns, where low-and-slow tactics and decentralized botnets now outmaneuver conventional defenses. DataDome’s real-time mitigation prevented the attack from crippling the platform, offering a case study in detecting threats through long-term behavioral analysis rather than static IP blocking.