Cloudflare said it detected and mitigated the largest-ever DDoS attack against HTTPS, at 26 million requests per second. Target was one of Cloudflare’s free customers. The announcement comes just two months after the company thwarted another major HTTPS DDoS attack against another of its customers.

As with the April attack, the attack came mainly from cloud service providers, not from established ISPs. This means that virtual machines and servers are compromised for the attack, not Internet of Things (IoT) devices. The botnet that carried out the attack consisted of 5,067 devices, each making 5,200 requests per second at the peak of the attack.

Cloudflare pointed out that this attack was carried out over HTTPS, which means that not only does launching an attack cost more money, but it is also mitigated. The botnet was hacked from 121 countries, with the most requests coming from Indonesia, the USA, Brazil and Russia. In addition, 3% of the attacks were carried out over the Tor connection.

Cloudflare said that all customers of its Free and Pro plans are protected from such attacks. Its protection is not measured and limited, so customers are not charged extra for services, regardless of the scale or duration of the attack. Source