Read the Docs Details Large-Scale DDoS Attack in June 2026

Overview of the June 2026 DDoS Attack

In mid-to-late June 2026, Read the Docs was subjected to its most significant distributed denial-of-service (DDoS) attack to date. The attack reached a peak of over 5.5 million requests per minute, which is approximately 100 times their typical baseline traffic. This incident persisted for nearly ten days, straining the platform's infrastructure, edge defenses, and incident response protocols.

Evolving Attack Sophistication

Unlike previous, simpler traffic floods, this attack demonstrated a higher level of sophistication. It was highly distributed, originating from millions of unique IP addresses across hundreds of networks globally, including residential blocks and hosting providers. The attackers also rapidly adapted to defenses and specifically targeted areas that bypassed caching mechanisms.

The attack also featured header and TLS randomization, where HTTP request headers and TLS connection parameters were systematically altered to evade signature-based filters like JA3/JA4. This technique made it harder for traditional security measures to identify and block malicious traffic.

Limitations of Existing Defenses

Read the Docs utilizes Cloudflare for protection, but even Cloudflare's automated DDoS mitigation, while effective against known botnets, allowed a significant portion of the attack traffic to bypass initial checks and reach Read the Docs' rate limiting and Web Application Firewall (WAF) rules. This indicates that automated CDN defenses may struggle against highly sophisticated and adaptive DDoS campaigns.

The attack also deliberately targeted URLs that resulted in cache misses, such as non-existent pages, further increasing the load on the origin servers and bypassing caching layers designed to absorb traffic spikes.

Impact and Industry Context

This event underscores a broader trend of increasing sophistication in DDoS attacks, particularly with the rise of AI crawlers and proxy networks making it easier to launch large-scale, distributed assaults. The experience of Read the Docs, a key documentation hosting platform, provides insights into the challenges faced by online services in maintaining availability against persistent and adaptive threats.