How Read the Docs survived a 5.5M req/min adaptive DDoS attack

In late June 2026, Read the Docs weathered the largest DDoS attack in its history: a nearly ten-day assault that peaked at 5.5 million requests per minute, roughly 100 times normal traffic. What set it apart from prior scraper floods was its sophistication. The traffic came from millions of unique IPs spanning hundreds of ASNs worldwide, including residential blocks and hosting providers, and the attackers randomized HTTP headers and TLS parameters to defeat signature-based filtering like JA3/JA4. Because the attack was genuinely global rather than concentrated in a few networks or fingerprints, per-colo rate limiting struggled to distinguish it from legitimate crawlers.

The operators deliberately hunted for weak points that bypassed caching, hammering cache-missing endpoints such as unique 404 paths and 302 redirects served by the Python backend rather than the edge. They probed defenses using a ‘yo-yo’ pattern, ramping up to find rate-limit thresholds then backing off to let windows reset, a tactic designed to drive up auto-scaling costs and cause intermittent degradation. When Read the Docs blocked or throttled one vector, the botnet rotated paths and spread across broader IP pools. Cloudflare’s automated protection caught known botnets, but much of the traffic slipped past to the origin’s WAF and rate-limiting layers.

The response leaned on defense-in-depth rather than a blanket JavaScript challenge, which would have broken API integrations and disrupted hundreds of thousands of legitimate readers. The team pushed redirects to be served at the edge, tightened aggressive caching (including short-lived Cache-Control on redirects and 200s), and combined bot-probability scores with per-IP rate limits managed via Terraform. The episode underscores a broader shift: the surge in AI crawlers over the past two years has made cheap, proxy-backed scraping trivial, and infrastructure providers now face distributed, adaptive attacks that render simple IP-based rate limiting inadequate.