Read the Docs published its DDoS post-mortem: 5.5 million requests per minute against a 100K baseline
The post-mortem published 2026-09-09 details a near-ten-day attack in mid-to-late June 2026 that peaked at 5.5 million requests per minute against a normal baseline under 100K, sourced from millions of unique IPs across hundreds of networks. The attackers randomized HTTP headers and TLS parameters, targeted uncached URLs like 404s and 302 redirects to slip past the CDN, and adapted whenever defenses shipped. What made it possible, the team argues, is that two years of AI scraper abuse taught attackers to plug an AI-generated scraper into a proxy network; the fixes that worked were edge-caching error pages, TLS-anomaly request fingerprinting, bot probability scoring, and moving dynamic redirects to Cloudflare edge workers.
↳ Follow the thread