A Distributed Denial-of-Service (DDoS) attack is a coordinated cyber assault in which multiple compromised systems flood a target, such as a website, application, or network, with overwhelming amounts of traffic. The goal is to exhaust the target’s bandwidth, processing power, or network capacity, rendering legitimate services unavailable to real users.
The term DDoS stands for Distributed Denial of Service. It expands on the traditional Denial-of-Service (DoS) model, which typically originates from a single source. In a DDoS event, the attack is launched from hundreds or thousands of geographically dispersed systems, making it far more difficult to stop or trace.
DDoS attacks are illegal under U.S. and international law, as they deliberately disrupt online services, inflict operational and financial harm, and erode public trust. For organizations that rely on continuous uptime, such as e-commerce platforms, financial institutions, and SaaS providers, DDoS attacks pose a major threat to both availability and reputation.
Understanding how DDoS attacks operate helps clarify why they are so difficult to defend against. At their core, these attacks use volume and coordination to overwhelm a target’s capacity.
Attackers typically leverage botnets, networks of malware-infected computers or IoT devices, that act in unison to send large volumes of requests toward a single target. As the server or network struggles to process the flood of data, legitimate users experience slow performance or total outages. Because the attacking devices are distributed globally, blocking traffic based on IP addresses alone rarely works.
Modern DDoS campaigns are automated, adaptive, and multi-layered. Attackers frequently change methods midstream, switching between volumetric, protocol, and application-layer vectors to bypass defenses. To mitigate these threats, organizations deploy techniques such as traffic scrubbing, rate limiting, and DNS-layer filtering that identify and drop malicious traffic before it reaches the application layer.
DDoS attacks can target different layers of the network stack, each with a unique strategy and goal. Understanding these categories helps defenders recognize the scope of modern DDoS campaigns.
|
Type |
Description |
Examples |
|
Volumetric Attacks |
Flood network bandwidth with overwhelming data volumes. |
UDP floods, amplification attacks |
|
Protocol Attacks |
Exploit weaknesses in network protocols to exhaust server resources. |
TCP SYN floods, ICMP floods |
|
Application-Layer (Layer 7) Attacks |
Target the application layer with fake HTTP or API requests that mimic legitimate traffic. |
HTTP floods |
|
Multi-Vector Attacks |
Combine multiple methods within one campaign for greater disruption and evasion. |
Mixed UDP + HTTP attacks |
Note: Some classifications treat DNS amplification as a distinct subtype because it abuses open DNS resolvers to amplify traffic volume against a victim.
Attackers use a wide range of methods to execute DDoS campaigns, often combining several at once to maximize disruption. Below are some of the most common techniques seen in the wild.
While DDoS campaigns can vary in size and sophistication, the underlying motivations often reveal the attacker’s intent. Some seek financial gain, others disruption or notoriety.
The effects of a DDoS attack can extend well beyond the initial outage, affecting both the victim and connected services. These attacks can have lasting financial, operational, and reputational consequences.
Even brief disruptions can ripple through interconnected systems, disrupting supply chains, customer experiences, and service-level commitments.
Historical examples show how DDoS attacks have evolved from crude bandwidth floods into sophisticated, multi-vector operations.
Today, most large-scale attacks are mitigated automatically by Anycast routing, DNS-layer protection, and cloud-based scrubbing centers, preventing widespread service outages before end users notice.
Data from recent years highlights how DDoS has evolved into a constant background threat rather than an occasional disruption. Attackers are scaling up both in capacity and organization, using automation to sustain pressure on global infrastructure.
The scale and frequency of DDoS activity continue to rise. Attacks have shifted from isolated incidents to a persistent risk that demands proactive monitoring and always-on, DNS-aware defense strategies.
DDoS attacks often overlap with other network-layer and DNS-based concepts. The following terms expand on related mechanisms and defenses:
Stop attacks before they take down your network. Start your free trial of DNSFilter and block malicious traffic at the DNS layer for faster, always-on protection against DDoS and command and control threats.