DDoS
Knocking a site offline by flooding it with more traffic than it can handle.
A DDoS attack (distributed denial of service) does not break into anything: it buries a website or service under so many requests that real users cannot get through. Every server, link and router has a limit; push enough traffic at it and it slows to a crawl or falls over. 'Distributed' means the flood comes from thousands or millions of machines at once, so blocking a single IP address does nothing.
Those machines are usually a botnet: computers, routers, security cameras and other devices infected with malware and controlled remotely, mostly without their owners noticing. The attacker, or someone who rents the botnet to them by the hour, tells them all to send traffic at the same target. Some attacks fill the network pipe with raw volume; others are subtler and send requests that look normal but are expensive for the server to answer, like repeated searches or logins.
The defense is mostly size and filtering. Services like AWS Shield or Cloudflare sit in front of the site, spread across data centers all over the world, so the flood is absorbed by a network far bigger than any attack, and scrubbing systems separate the bot traffic from the people. A CDN helps on its own, because cached pages are served from the edge without touching the origin. Attacks are often used for extortion, protest or as a distraction while something else happens.
Keep in mind
- A DDoS overwhelms a service with traffic; it steals nothing, it makes the service unusable.
- The traffic comes from a botnet of infected devices, so blocking one address is useless.
- Protection comes from huge networks that absorb and filter the flood before it reaches you.
- Some attacks use raw volume, others cheap-to-send, expensive-to-answer requests.
