DDoS: When a Crowd of Fake Visitors Takes a Website Down

The 30-second explanation

Picture a shop with a thousand people who walk in and just stand there, doing nothing. Real customers can't get through the door. That's a DDoS attack, aimed at a website instead of a shop.

How it works

1. 1

   1. Build a crowd

   Many devices are hijacked or simply rented for the job.

2. 2

   2. Aim

   The attacker settles on a target site or service.

3. 3

   3. Flood

   Every device sends requests at the same moment.

4. 4

   4. Denial

   Real users start seeing errors and timeouts.

The attacker controls a large number of devices, frequently infected computers, cameras or home routers their owners never notice have been compromised, and tells all of them to send requests at one target simultaneously. The target burns its capacity answering fake requests and has nothing left for real ones. Defenders respond by absorbing that traffic across large networks, filtering the obviously bad requests, and applying rate limits before things get that far. It's an availability attack rather than a confidentiality one: nothing is usually stolen, the service is just made unreachable.

Real-world example

How to spot it

• A sudden traffic spike

  Volume far above the site's normal baseline, from unusual places.

• Slow or unreachable pages

  Timeouts appearing across the whole site at once.

• Requests that look identical

  Thousands of near-identical requests hitting the same page.

• Ransom demands

  A note threatening even more traffic unless paid.

What to do

1. 1Put public-facing services behind a provider built to absorb and filter large floods of traffic.
2. 2Set rate limits and learn your normal traffic levels, so an attack stands out.
3. 3Have a plan and contacts ready before an attack hits, including how you'll talk to users.