| 20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and suddenly you’re flooded with 200,000 additional IP addresses hammering at your site, you have a problem. To put it in perspective, the top post on HN most of yesterday was about someone benchmarking their personal server as being able to handle about 5 million requests per day (Granted, that’s quite slow, but it will suffice for making a point). This botnet can deliver 4X that server’s total daily capacity every second. |