DDoS attacks are the most "visible" cyber attack — they take services offline in plain view. 2025 saw several Indian banks, government portals, and gaming platforms knocked off the internet for hours. This guide explains how modern DDoS attacks work, why they keep getting bigger, and what every Indian business should do about them.
DDoS in One Sentence
Distributed Denial of Service = a flood of traffic from many compromised devices, sent at one target, with the goal of making it unreachable to legitimate users.
The Three Main Types
1. Volumetric Attacks (most common)
Simply flood the network pipe — UDP floods, ICMP floods, DNS amplification. Measured in Gbps / Tbps. The biggest DDoS in 2025 hit 5+ Tbps.
2. Protocol Attacks
Exhaust state on firewalls / load balancers — SYN floods, ping-of-death, fragmented packet attacks. Measured in packets per second.
3. Application-Layer (Layer 7) Attacks
Send "valid" HTTP requests but at huge volume — login pages, search APIs, anything CPU-heavy. Hardest to block because traffic looks legit.
Recent Notable India Incidents
- Public sector bank login portal — 6 hours offline during peak salary day (Q3 2025)
- Major UPI app — repeated outages traced partly to DDoS (multiple events 2024–25)
- Government e-services portal during election season — repeated mitigations
- Indian gaming platforms (RMG / fantasy) — relentless target during IPL season
If you operate a high-traffic Indian web service in 2026 and you have not been DDoSed yet, it's only a matter of time.
How DDoS Attackers Get Their Firepower
- Botnets: compromised IoT devices, routers, security cameras (Mirai-style)
- Reflection / amplification: abuse misconfigured DNS / NTP / Memcached servers — small request, huge response
- Booter / stresser services: ₹1,500 buys you a 30 Gbps attack on the dark web
- Hijacked cloud accounts: compromised AWS/GCP accounts run massive attacks for free
How to Defend (Realistic 2026 Playbook)
For Small Businesses (under ₹100 Cr revenue)
- Cloudflare or BunnyCDN — free / cheap DDoS protection at the edge
- Hide origin IP behind the CDN
- Rate-limit login + search APIs at the application layer
- Use a managed WAF
For Mid-Large Enterprises
- Cloudflare Business / Enterprise, Akamai, AWS Shield Advanced
- Anycast network for DNS
- Bot management (separate product, not basic WAF)
- Incident-response plan with named owners and rehearsed runbooks
- ISP-level scrubbing contracts
For Banks / Critical Infrastructure
- All of the above, plus
- Multiple Tier-1 ISPs with BGP-based blackholing
- 24x7 dedicated SOC with playbooks
- Quarterly DDoS simulation drills
DDoS in Bug-Bounty / Pen-Test Scope
DDoS testing is almost ALWAYS out of scope in bug bounty programs. Never attempt it. Even research-grade load testing on a production service without explicit written approval is a crime under the IT Act 2000.
Where DDoS Skills Pay
- DDoS defense engineering at telcos / banks — ₹12 – 30 LPA
- SOC / IR with DDoS specialty — ₹10 – 25 LPA
- Anti-bot / WAF specialists at Cloudflare, Akamai, F5 — ₹20 – 50 LPA
Train at Cyber Defence Academy, Hisar
Hands-on labs, real-world projects, government-of-India trusted institute. Online + offline batches across Haryana. Placement support, lifetime access to materials.
FAQs
Is DDoS the same as a hack?
No. DDoS makes a service unavailable; a hack typically breaches confidentiality or integrity.
Can a single attacker run a DDoS?
Yes — booter services let a single attacker rent botnet capacity by the hour.
How long do DDoS attacks usually last?
Most are under 30 minutes; high-profile ones can last hours or days with waves.