We observed unusual behavior during a DDoS attack on an import-export company. A botnet analyzed its own failures and recalibrated itself in real time. The botnet shrank during the attack yet didn’t lose any strength.
The attack lasted less than five minutes but reached 1.7 billion requests per second at its peak. At first, it appeared to be a brief, intense spike. However, upon closer analysis, it became clear that this was a botnet that actively optimized its own composition during the attack.
What a Shrinking Botnet Reveals About Its Operator
The attack began with approximately 3,000 source IP addresses, a relatively large number for a volumetric DDoS attack. However, what happened next was unusual. The number of active IP addresses dropped over the course of the attack, at times falling to fewer than 600, while the number of sessions per remaining IP address increased. The total volume, or requests per second and overall impact on the target, remained constant throughout. In other words, the attackers did not relent; they simply shifted their strategy.
The most likely explanation is that the attack system detected in real time which IP addresses had been filtered out by rate-limiting rules or dynamic blocking logic and increased the load on the remaining unblocked IP addresses. Rather than activating more resources, the existing ones were used more efficiently. In other words, this was resource optimization or adaptation during the attack itself: fewer IPs, same request rate, same impact.
Fewer IPs, same request rate, same impact. The botnet did not stop. Rather, it learned which IP addresses could still be used and shifted the load to them.
Why the source infrastructure was not an IoT botnet
The IP addresses behind the attack traffic did not belong to household appliances or compromised home routers. Rather, the sources could be traced to telecommunications providers, fiber-optic infrastructure operators, and high-capacity data networks, including ISPs in the Asia-Pacific region that explicitly advertise high network bandwidth. This infrastructure can establish significantly more sessions per node than a typical IoT device.
This explains why the botnet was able to generate the same session load despite a decreasing number of IP addresses. The remaining nodes had enough computing power and bandwidth to compensate for the IPs that dropped out. This strategy would have failed with an IoT botnet—the individual devices simply wouldn’t be powerful enough. Anyone carrying out such an attack has access to real server infrastructure.
The pattern revealed the real message
The mitigation worked. Requests per IP address were detected and blocked via configured rate-limiting rules, and suspicious IP addresses were quarantined. The attack was fully mitigated without the origin server crashing under the load. That’s the good news. The bad news: The botnet reacted to these blocks. It didn’t just keep firing until it ran out of ammunition. It adjusted its strategy.
Whether this adjustment was automated, i.e., through control logic that evaluates block responses and modifies its own behavior accordingly, or carried out by a human operator making real-time adjustments, cannot be determined conclusively from the available data. Both scenarios are technically possible and concerning. This is because static mitigation rules based on fixed IP thresholds can be systematically circumvented by such attacks.
A botnet that reacts to blocking signals and reallocates its resources renders every static threshold ineffective. Anyone who blocks 300 requests per IP address today will see 299 requests from twice as many IP addresses tomorrow.
What Adaptive Botnet Attacks Mean for Defense
Traditional DDoS mitigation relies on thresholds. For example, if an IP address sends more than X requests per unit of time, it is blocked. This method is effective until the attacker learns the threshold and uses it to control their own infrastructure. Adaptive botnets do not render static rules useless. However, they demonstrate that thresholds alone are not sufficient for defending against adaptive attackers.
Learn how the new Network DDoS Protection protects you even more effectively
Faster mitigation, IPv6 parity, greater transparency, and significantly less manual effort.
In such a situation, the layers that make the difference are behavior-based detection over time, session anomalies per IP block, and the ability to recognize attack patterns even when individual IPs remain under the radar. Furthermore: Attacks lasting less than five minutes but generating 1.7 billion requests per second are no longer rare. They are the new normal for targets that know what they need to protect.
Adaptive botnets are not just a future scenario; they are already active in our networks. Talk to our experts about how behavior-based detection can complement your static thresholds.
You might also like:
