Record-breaking DDoS attacks are useful to study not for the headline numbers but for what each one revealed about a weakness in the internet. Here are the landmark attacks in the public record, in rough chronological order, and the lesson each left behind.
2016 — Mirai and the Dyn Attack
In October 2016, the Mirai botnet — built from hundreds of thousands of hijacked IoT devices like cameras and routers — hit the DNS provider Dyn with an attack estimated around 1.2 Tbps. Because Dyn served DNS for major sites, the outage took down Twitter, Reddit, Netflix and others across large parts of the US. The lesson: insecure IoT devices are a standing army, and attacking shared infrastructure (like DNS) multiplies the damage.
2018 — The 1.35 Tbps GitHub Attack
In February 2018, GitHub was hit with 1.35 Tbps of traffic — at the time the largest recorded — using Memcached reflection. Attackers abused thousands of misconfigured Memcached servers exposed on the public internet, each amplifying a tiny request into a response up to 51,000 times larger. GitHub stayed down only briefly because it was already behind DDoS protection. The lesson: amplification via exposed UDP services can produce enormous floods, and being behind mitigation before the attack is what saved them.
2020 — The 2.3 Tbps AWS Attack
In February 2020, AWS reported mitigating a 2.3 Tbps attack that used CLDAP reflection — another amplification vector abusing exposed directory-service servers. Google separately disclosed that it had absorbed a 2.5 Tbps attack years earlier. The lesson: the ceiling on volumetric attacks keeps rising, and only providers with very large networks can absorb the biggest floods.
2023 — HTTP/2 Rapid Reset
In late 2023, a new technique called HTTP/2 Rapid Reset produced application-layer attacks measured in the hundreds of millions of requests per second — the largest Layer 7 floods seen to that point. Instead of raw bandwidth, it abused a flaw in how HTTP/2 handles rapidly cancelled streams. The lesson: the frontier moved from volumetric (bandwidth) to application-layer (request-rate) attacks, which are cheaper to launch and harder to distinguish from real traffic.
The pattern across every record
Almost every record attack exploited something left exposed — insecure IoT devices, open UDP reflectors, an unpatched protocol. The volumetric giants are absorbed by big networks; the growing threat for a normal-sized site is the Layer 7 flood, which needs a reverse proxy that inspects the request, not just the packet count.
What It Means for a Normal-Sized Site
You are extremely unlikely to be hit by a multi-terabit attack — those target the largest platforms. What actually takes small and mid-size sites offline is a far smaller application-layer flood aimed at an expensive endpoint, or a volumetric attack that simply exceeds a modest server's bandwidth. The practical defence is the same one that saved GitHub: be behind protection before it happens. Route your traffic through a reverse proxy that filters Layer 7 attacks and hides your origin, and let your host or transit provider handle raw volumetric floods.