Read the Docs Survives a 5.5M Requests-Per-Minute DDoS Attack
Understanding the recent DDoS attack against Read the Docs
In June 2026, Read the Docs faced the largest DDoS attack in its history, peaking at 5.5 million requests per minute—100 times normal traffic—and lasting nearly ten days. The attack was globally distributed, randomized headers and TLS parameters, and deliberately targeted uncached URLs to bypass defenses. The team shares how they mitigated it using edge caching, targeted rate limiting, and bot fingerprinting, while avoiding blanket JavaScript challenges that would disrupt legitimate users. Key lessons include the obsolescence of IP blocking and the necessity of aggressive caching.
The fastest request is the one served by the CDN or the web app firewall.
- Animats
I'd like to see more of a legal response.
First, find out who's on the other end of a few hundred IP addresses. Start with ones in the US. Sue for damages. Use discovery to find out what's on the other end. Sue the maker of that device. If it turns out to be an appliance or smart TV, it may be possible to consolidate cases into one case against the manufacturer. Criminal negligence, tort interference with contract, harassment, Computer Fraud and Abuse act violation...
Maybe a restraining order prohibiting the sale of "smart TV" known to be able to host attacks. Have imports seized by Customs and Border Protection. That would get a manufacturer's attention.
The manufacturer's EULA will not help the manufacturer, because the plaintiff, the party being attacked, is not a party to the EULA at all.
- fn-mote
There’s an assumption that turning on Cloudflare’s “under attack” mode would mitigate the attack.
Given how adaptive the rest of the attack was, I would be very curious to find out how it would approach that obstacle.
- bijowo1676
this might be a AI driven attack and readthedocs was just a test target.
What surprised me is how easy it was to evade the cloudflare defenses. I know it was easy to evade CF, but I would expected CF to do a better job at blocking L7 DDOS.
CF is really good in defending against the L4 DDOS, but not L7.
this means that cloudflare is really not useful much in the era of Agentic DDOS driven by thousands agents across the globe
- Onavo
A more interesting question is, what exactly do the attackers gain from hitting read the docs? Most of their docs hosting is static/easily CDN cached. Unlike database bound sites, you would need a lot more traffic to overload pure/mostly static hosting. Maybe it's a malicious AI lab looking to deny their competitors training data? As far as infosec profiling goes, this is probably the oddest case I have heard of.
I am thinking it's probably an AI lab that misconfigured their data scraper (made it too agentic) and it ended up looking like a DDoS.
The new generation of scrapers are all agentic and self healing. (As an example see YC's https://parse.bot)
- bennett_dev
Interesting that the Under Attack Mode wasn’t used at all here. I understand not wanting to break APIs but I feel temporarily challenging non-API usage could have at least helped without impacting users too much?