DDoS
/ˈdiːdɒs/ · Abbreviation · Noun · Security & Infosec · Origin: 1999
Definitions
Distributed Denial of Service — an attack that floods a target server or network with traffic from many compromised machines simultaneously, overwhelming it until legitimate users can no longer connect.
In plain English: Thousands of computers all hitting the same website at once, like a million people trying to squeeze through one door, so nobody can get in.
DDoS attacks have grown from gigabits to terabits per second. The largest recorded attack (2024) exceeded 5 Tbps. Defense requires a multi-layered approach: CDN-based mitigation, rate limiting, traffic analysis, and upstream provider filtering. You can't out-bandwidth an attacker — you have to outsmart them.
Example: 'We absorbed a 300 Gbps DDoS attack with zero downtime because Cloudflare's network ate the traffic before it reached our origin servers.'
Source: scale / defense
Etymology
- 1996
- Panix, a New York ISP, suffers what is considered the first major DDoS attack via SYN flooding
- 1999
- The term 'Distributed Denial of Service' is formalized as attackers begin using botnets instead of single machines
- 2000
- 15-year-old 'Mafiaboy' takes down Yahoo, eBay, CNN, and Amazon in a spree that brings DDoS to mainstream attention
- 2016
- The Mirai botnet harnesses IoT devices to launch a 1.2 Tbps DDoS attack against Dyn, taking down much of the U.S. internet
Origin Story
From IRC wars to weapons of geopolitical conflict
Distributed denial-of-service attacks evolved from simple 'nukes' on IRC (Internet Relay Chat) in the early 1990s. Kids on IRC discovered that flooding a user's connection with traffic could knock them offline — a digital power trip.
The first major DDoS attacks hit the mainstream internet in February 2000, when a 15-year-old Canadian known as 'MaFiABoY' took down Yahoo, Amazon, eBay, and CNN using a tool that coordinated hundreds of compromised machines. The attacks cost an estimated $1.7 billion and put DDoS on the map.
Since then, DDoS attacks have grown from megabits to terabits per second, powered by botnets of compromised IoT devices. They've been used for extortion, hacktivism, and nation-state warfare. The 2016 Mirai botnet, built from insecure webcams and DVRs, took down major chunks of the US internet by attacking DNS provider Dyn.
Context: IRC culture, early 1990s; mainstream awareness 2000
Fun fact: The MaFiABoY attacks in 2000 were so disruptive that President Clinton convened a cybersecurity summit at the White House in response.