Defending the Internet: how Cloudflare blocked a monumental 7.3 Tbps DDoS attack

In mid-May 2025 Cloudflare reported autonomously blocking a record 7.3 Tbps multivector DDoS attack against a hosting-provider customer using Magic Transit; the 45-second attack delivered 37.4 TB, originated from ~122,145 source IPs across 5,433 ASNs and 161 countries, and was ~99.996% UDP floods with small contributions from multiple reflection/amplification vectors (QOTD, Echo, NTP, Portmap, RIPv1) and Mirai-like IoT traffic. Cloudflare details detection and mitigation methods (XDP/eBPF sampling, dosd fingerprinting, anycast distribution), provides per-vector prevention guidance, and offers a botnet threat feed to help service providers identify abusive accounts.