Google Cloud Armor Defends Against the Largest DDoS Attack in History: Lessons for 2026

Google Cloud Armor recently thwarted the most powerful DDoS attack recorded, reaching 46 million requests per second. Learn how adaptive defenses and proactive traffic analysis protected one client’s services and maintained online operations.

Ozan Ucar, Founder and CEO of Keepnet

Last Updated: 2026-06-01

Google Faces Largest DDoS Attack in History on Cloud Armor Client

In June 2022, Google Cloud Armor encountered and successfully deflected the largest Layer 7 DDoS attack ever recorded at the time, peaking at 46 million HTTPS requests per second. The attack originated from approximately 5,256 source IP addresses across 132 countries, consistent with a large distributed botnet. By 2026, the record set in that attack has been surpassed multiple times: Microsoft reported mitigating a 3.47 Tbps volumetric attack in 2021, and researchers documented Layer 7 attacks exceeding 71 million rps in early 2023. DDoS attacks have continued to grow in scale, sophistication, and frequency, with the annual number of DDoS events exceeding 13 million globally by 2025.

What Happened on June 1, 2022?

The attack on Google Cloud Armor's client began on June 1, 2022, at approximately 09:45 BST, aiming targeted HTTPS flood traffic at a Cloud Armor-protected workload. The attack began at 10,000 requests per second and scaled rapidly over the following eight minutes.

Two minutes later, the attack surged to its peak, sending 46 million rps. Google Cloud Armor’s client services, however, remained online, with the Cloud Armor adaptive security rule allowing normal operations to continue. The attack ultimately lasted just over an hour and involved more than 5,000 source IP addresses from 132 countries.

Why Was This Attack So Powerful?

DDoS attacks have evolved rapidly, with threat actors increasingly leveraging Layer 7 DDoS attacks that mimic legitimate application traffic. The Google Cloud Armor attack used HTTP/2 multiplexing and HTTPS encryption to maximize requests per connection while making filtering harder. By 2026, AI-generated attack traffic has emerged as a new challenge: some botnet operators now use machine learning to generate request patterns that more closely resemble legitimate user behavior, reducing the effectiveness of behavioral rate limiting while maintaining attack volume.

The recent Google Cloud Armor attack underscores the role of highly distributed, global botnets. The scale, in this case, was astounding, requiring Google Cloud Armor to analyze and respond to traffic in near real time as it reached volumes far beyond historical precedents.

How Google Cloud Armor's Adaptive Defenses Prevented Disaster

Google Cloud Armor’s adaptive defenses enabled real time responses by analyzing and categorizing incoming traffic as soon as the attack began. Within eight minutes of the initial onslaught, Cloud Armor’s traffic analysis algorithms began flagging suspicious patterns and behaviors across the network. The system quickly generated and delivered a custom rule to the affected customer, designed to intercept and deflect malicious traffic without affecting legitimate requests.

Early Detection and Response

In highly sophisticated attacks like this, early detection is crucial to preventing service degradation. Cloud Armor’s traffic analysis detected a rise in request patterns within seconds, allowing the system to activate an adaptive rule before the attack reached its full capacity.

Real Time Traffic Analysis: Google Cloud Armor continuously analyzed traffic patterns, detecting abnormal request spikes and potential malicious behaviors across the network.
Alert and Custom Signature Generation: Based on this analysis, Cloud Armor generated a signature rule that specifically targeted malicious traffic while preserving legitimate access.
Automated Defense Activation: As the attack intensified, Cloud Armor activated this signature rule, applying it to the affected services.

Global Botnet Involvement and Attack Scale

The attack’s traffic was distributed across 5,256 source IP addresses in 132 countries, highlighting the global scale of the botnet responsible. Attackers often exploit networks of compromised devices worldwide to intensify traffic, making it difficult to mitigate these attacks by blocking specific geographic regions or networks. Cloud Armor’s global presence and machine learning based analysis allowed it to address this challenge, identifying and blocking malicious IPs across regions.

Lessons for Businesses Facing High Level DDoS Threats

This attack provides a critical example of how proactive, adaptive security measures can minimize service downtime and financial loss, even against unprecedented threats. Here are the primary takeaways for organizations needing robust DDoS defense.

1. Implement Adaptive DDoS Protection

Layer 7 DDoS attacks are challenging because they mimic legitimate user requests, making traditional DDoS defenses less effective. Adaptive solutions, like Google Cloud Armor, use behavioral analysis and machine learning to differentiate between legitimate and malicious traffic, even when attack patterns change dynamically.

Explore more on Cybersecurity Awareness Training to ensure your employees are prepared for advanced threats.

2. Prioritize Early Detection

Attackers are using increasingly complex methods to mask their traffic, making early detection crucial to maintaining service availability. Leveraging advanced traffic monitoring tools can enable your team to detect and respond to irregular traffic patterns in seconds, minimizing the chance of successful service disruption.

For effective Phishing Simulations to bolster your team’s detection skills, check out our comprehensive tools.

3. Use Multi Layered DDoS Mitigation Strategies

To prevent attacks at different levels, businesses should combine application layer defenses with network layer defenses. This holistic approach minimizes the potential for attackers to overwhelm any single defensive layer.

For more on strategies to manage human risk effectively, see our insights.

4. Deploy Adaptive Rules Based on Real Time Traffic Insights

For those experiencing high stakes threats, Cloud Armor’s approach illustrates the value of real time adaptive rule deployment based on live data insights. This allows organizations to customize defenses against specific attack types as they evolve during an incident.

Explore Incident Response Solutions for efficient management of attacks when they do occur.

The Future of DDoS Mitigation in Cloud Environments

The 2022 Google Cloud Armor attack remains a landmark reference point for DDoS scale and defense. In 2026, the lessons it demonstrated have been validated repeatedly: organizations that rely on static, threshold-based DDoS defenses without adaptive protection consistently suffer longer outages than those with cloud-native adaptive mitigation. The attack also demonstrated that botnet scale is no longer a limiting factor — the infrastructure to generate tens of millions of requests per second is accessible to well-resourced threat actors, making cloud-scale DDoS protection a baseline requirement rather than an advanced capability.

What the Google DDoS Attack Means for Organizations in 2026

DDoS attacks at the scale Google mitigated in 2022 are no longer exceptional events. As botnet infrastructure has become more accessible and cloud native applications have expanded attack surfaces, organizations of all sizes face elevated DDoS risk. The Google Cloud Armor response demonstrated that effective defense requires real time traffic analysis, adaptive rule deployment, and the capacity to absorb traffic at enormous scale. For most organizations, this means partnering with cloud providers that have built in DDoS mitigation rather than attempting to build standalone defenses.

While DDoS attacks are primarily technical, the human layer matters too. Employees who recognize the signs of an ongoing DDoS incident, follow the correct escalation procedure, and do not make configuration changes under pressure that could worsen the situation contribute to faster recovery. Keepnet's Security Awareness Training includes incident response behavior modules that prepare employees for high pressure scenarios including active attacks.

Editor's Note: This article was updated on June 1, 2026.

Schedule your 30-minute demo now

You'll learn how to:

Recognize and respond to Layer 7 DDoS threats with adaptive defense mechanisms.

Utilize real-time analysis to prevent service degradation from massive DDoS attacks.

Implement rules tailored to block malicious traffic without affecting legitimate requests.

Frequently Asked Questions

What was the largest DDoS attack ever recorded and when did it occur?

On June 1, 2022, Google Cloud Armor successfully mitigated a DDoS attack that peaked at 46 million requests per second (rps). This was the largest Layer 7 HTTPS DDoS attack ever recorded at the time, approximately 76% larger than the previous record. The attack lasted approximately 69 minutes in total, with the peak sustained for just over a minute. Traffic originated from 5,256 source IP addresses across 132 countries, indicating a highly distributed global botnet.

What is a Layer 7 DDoS attack and why is it more challenging to defend against?

A Layer 7 DDoS attack targets the application layer of the network stack, sending HTTP or HTTPS requests that appear to be legitimate user traffic. Unlike volumetric attacks that simply flood network bandwidth, Layer 7 attacks consume server processing resources by requiring the server to handle each request as if it were a real user query. This makes them harder to defend against because the attack traffic looks like genuine application usage, and filtering it out requires analysis of request content and behavior rather than simple IP or protocol blocking.

How did Google Cloud Armor detect and mitigate the attack?

Google Cloud Armor's adaptive protection system detected the unusual traffic patterns within the first two minutes of the attack and generated a recommended blocking rule. Security engineers reviewed and deployed the rule, which blocked the majority of malicious traffic while allowing legitimate requests to pass. The system continuously analyzed traffic and updated its rules as the attack evolved. The attack's geographic and IP diversity, spanning 132 countries, required blocking rules that could distinguish malicious traffic patterns without affecting legitimate global users.

What is a botnet and how was one used in the Google DDoS attack?

A botnet is a network of compromised devices controlled remotely by an attacker. In DDoS attacks, botnets are used to generate traffic from a large number of sources simultaneously, making it impossible to block the attack by filtering a small number of IP addresses. The Google attack used approximately 5,256 source IPs across 132 countries. This geographic diversity is a characteristic of Mēris-style botnets, which primarily comprise compromised network devices such as routers and network appliances rather than traditional endpoint computers.

What is HTTPS DDoS and why is it more resource intensive than HTTP DDoS?

HTTPS DDoS attacks require TLS handshake processing in addition to standard HTTP request handling. Every HTTPS connection requires cryptographic operations to establish a secure session, which consumes significantly more CPU resources on the server than a plain HTTP connection. This means HTTPS DDoS attacks can exhaust server processing capacity with fewer total requests than HTTP attacks, making them more efficient from an attacker's perspective. The use of HTTPS also means the traffic appears encrypted and legitimate, complicating inspection based defenses.

What is adaptive protection in DDoS defense?

Adaptive protection uses machine learning to build a baseline model of normal traffic for a protected application and then automatically detects anomalies that may indicate an attack. When an attack is detected, the system can automatically generate recommended blocking rules tuned to the specific attack pattern. The rules are presented to security teams for review and deployment or, in fully automated configurations, deployed automatically. This approach is far faster than manually analyzing traffic and writing blocking rules under the pressure of an active attack.

How should small and medium sized organizations protect against DDoS attacks?

Most small and medium sized organizations cannot build DDoS defenses at the scale of large cloud providers. The practical approach is to use cloud based DDoS protection services offered by CDN and cloud infrastructure providers, ensure web applications are hosted behind services that include built in DDoS mitigation, maintain an incident response plan that includes DDoS scenarios, implement rate limiting and access controls at the application layer, and conduct regular load testing to understand their systems' capacity limits before an attack occurs.

What is the Mēris botnet and why is it significant?

Mēris is a botnet composed primarily of compromised network infrastructure devices, particularly MikroTik routers, rather than traditional endpoint computers. Its significance lies in the fact that network devices have significantly more bandwidth and processing capability than average endpoints, making Mēris-powered attacks capable of generating far higher traffic volumes per compromised device. The Google attack bore characteristics consistent with Mēris, including the geographic distribution and the HTTP pipelining technique used to amplify request volume.

What can organizations learn from the Google Cloud Armor response about DDoS preparedness?

The key lessons are: baseline traffic monitoring must be in place before an attack occurs so anomalies can be detected immediately; response must be automated or semi automated because human reaction time is too slow at the scale of a major attack; defensive rules must be adaptive rather than static because attack patterns evolve during the incident; and having pre defined response procedures and clear escalation paths ensures the team can act decisively under pressure rather than improvising.

How does security awareness training contribute to DDoS incident response?

DDoS attacks create operational pressure that can lead to poor security decisions: disabling security controls to restore performance, making unreviewed configuration changes, or falling for social engineering attacks timed to coincide with the disruption. Training employees on DDoS incident response procedures ensures they know not to make unauthorized configuration changes during an attack, follow the escalation path correctly, and remain vigilant for secondary attacks such as phishing campaigns launched during the confusion of a DDoS event. Keepnet's Incident Responder provides structured response workflows that keep teams on track during high pressure incidents.