2.45 Billion Requests, 1.2 Million IPs: Why Traditional Rate Limiting Is Dead

What happened A massive DDoS campaign recently hit a large-scale user-generated content platform with over 2.45 billion malicious requests in just five hours. But this wasn't your typical brute-force flood. The attackers distributed traffic across 1.2 million unique IP addresses spanning 16,402 autonomous systems, keeping each individual IP's request rate so low that it looked completely legitimate in isolation. Each source averaged just one request every nine seconds. No single IP looked mal...