DDoS
/ DEE-doss /
A plain denial-of-service attack from one machine has a weakness: the target can spot that one noisy source and block it. So attackers scaled the idea up. Imagine that instead of one person jamming the shop's phone line, ten thousand people all over the world dial it at once — you can't just hang up on one of them, and you can't tell who's a real customer. A distributed denial-of-service (DDoS) attack floods a target from many sources simultaneously, making it both far more powerful and far harder to filter than a single-source DoS.
The attacking sources are usually a botnet: a large collection of computers, routers, cameras, and other Internet-connected devices that an attacker has secretly compromised with malware and can command remotely. On a signal, all of them direct traffic at the victim at once. The combined flood can be enormous — many machines each sending a modest amount adds up to overwhelming volume — and because the traffic genuinely originates from thousands of scattered, often innocent-looking devices, the victim can't simply blacklist one address. Attackers also amplify the effect using reflection tricks like DNS amplification, where small forged requests trigger large replies aimed at the victim.
Why it matters: DDoS is one of the dominant availability threats on the modern Internet, capable of knocking major services offline, and the rise of insecure IoT devices has made huge botnets easy to assemble. Defending it usually requires more than the victim alone can do: specialized DDoS-mitigation services and large content-delivery networks absorb and filter the flood across enormous distributed capacity, scrubbing out attack traffic before it reaches the target. The honest reality is that there's no perfect fix — defense is largely a contest of capacity and filtering skill against the attacker's firepower.
An attacker who controls a botnet of 50,000 compromised home routers and cameras commands them all to request a target website at the same instant. No single device sends much, but together they bury the site under traffic from tens of thousands of different IPs — impossible to block one by one. That's DDoS.
Many sources at once: too distributed to blacklist.
DDoS is hard precisely because the flood comes from thousands of real, scattered devices — you can't block 'the' attacker. Mitigation usually means large distributed capacity (CDNs, scrubbing services), not a single firewall rule.