// HACKER NEWS — CYBERSECURITY
Understanding the recent DDoS attack against Read the Docs
In mid-to-late June 2026, Read the Docs experienced the largest
and most sophisticated distributed denial-of-service (DDoS)
attack in our history.
At its peak, our infrastructure was hit with over
5.5 million requests per minute,
about 100 times our normal baseline traffic.
The incident lasted for nearly ten days,
testing our infrastructure, our edge defenses,
and our incident response processes.
Unlike simpler traffic floods we've seen in the past,
this attack was more distributed,
it adapted to our defenses rapidly,
and it purposefully attacked areas that bypassed caching.
Now that our small ops team is back to sleeping at normal hours,
we wanted to walk through the anatomy of this kind of attack,
why our existing rate limiting only partially mitigated it,
and what strategies actually helped us (mostly) maintain availability throughout the attack.
Read the Docs has historically been very tolerant toward spiders and bots scraping documentation we host, and IP-based rate limiting solved most abuse problems.
Starting about two years ago, we began seeing a significant uptick as AI crawlers became more prevalent and it seems other members of the dev infrastructure community are seeing similar issues.
It became straightforward to plug an AI-generated scraper into a proxy network. Our defenses adapted to that fairly easily, but the June attack was over 10x larger than anything we had faced.
Massive volume: At peak, we received 5.5 million requests per minute, compared to our normal daily peak of under 100k requests per minute.
Global distribution: We saw malicious requests originating from millions of unique IP addresses across hundreds of networks (ASNs) globally. This included residential IP blocks as well as major and minor hosting providers.
Header & TLS randomization: The attackers systematically randomized HTTP request headers and TLS connection parameters to evade signature-based filters (JA3/JA4).
Limitations of automated CDN defenses: Read the Docs uses Cloudflare and while Cloudflare's automated DDoS protection mitigated some traffic originating from what they called "known botnets", a big part of the attack passed that first check and got through to our rate limiting and WAF rules.
Cache evasion: Attackers found and deliberately targeted URLs that resulted in cache misses, such as non-existent pages with unique paths (404s) as well as temporary redirects (302s).
Adaptive behavior: When we implemented blocks or rate limits, the botnet adjusted its request rates, rotating through different target paths and spreading traffic across broader IP pools to probe our defense boundaries.