According to multiple reports, the attack used more than 1.2 million IP addresses distributed across over 16,000 autonomous systems (ASNs), making it one of the most fragmented HTTP DDoS campaigns observed so far.
Unlike older brute-force DDoS attacks that generate huge traffic from a smaller number of systems, this campaign used a so-called "low and slow" strategy.
How did the attack work?
Instead of flooding targets from a few aggressive IP addresses, the attackers distributed requests across an enormous number of systems.
Researchers reported:
- 2.45 billion requests
- More than 1.2 million IPs
- Around 205,000 requests per second peak
- Traffic from over 16,400 ASNs
- Requests spread over approximately 5 hours