GoKawiilRead the Docs weathers 10-day DDoS attack peaking at 5.5 million requests per minute
Read the Docs disclosed that in mid-to-late June 2026 it suffered its largest-ever DDoS attack, with traffic peaking at roughly 5.5 million requests per minute—about 100 times normal levels—and lasting nearly ten days. The attack used millions of distributed IP addresses across many networks, including residential and hosting providers, and randomized HTTP headers and TLS fingerprints to evade detection while specifically targeting endpoints that bypass caching.
GoKawiil's interpretation of the reporting above, not reported fact.
This shows how DDoS tactics have evolved well beyond simple IP-based floods, now leveraging AI-assisted scraping infrastructure and adaptive evasion techniques that defeat conventional rate limiting. For small open-source and infrastructure teams like Read the Docs, such attacks strain limited engineering resources and highlight the growing need for smarter, behavior-based edge defenses rather than static IP blocking.
- The attack hit 5.5 million requests per minute, 100x normal traffic, and lasted nearly 10 days.
- Attackers used millions of IPs across many ASNs, including residential networks, with randomized headers and TLS fingerprints.
- Traditional IP-based rate limiting only partially mitigated the attack, prompting Read the Docs to rethink its defense strategy.
Site Reliability Engineering (O'Reilly book) — Google's SRE book is the go-to reference for the exact problems Read the Docs' ops team faced: incident response, on-call rotations, load shedding, and keeping services available under extreme traffic. If reading about a 5.5-million-requests-per-minute attack made you want to harden your own stack, this is the classic starting point.
See Site Reliability Engineering (O'Reilly book) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: about.readthedocs.com — David Fischer, 2026-09-09
Published there as: “Understanding the Recent DDoS Attack Against Read the Docs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.