Read the Docs DDoS Postmortem Exposes Limits of Traditional Edge Rate Limiting

Read the Docs published an engineering postmortem detailing a sophisticated distributed denial-of-service (DDoS) attack that peaked at 5.5 million requests per minute—roughly 100 times normal traffic—and sustained disruption across a ten-day period. The attack bypassed initial automated CDN mitigations by utilizing millions of residential and hosting IP addresses across hundreds of Autonomous System Numbers (ASNs) worldwide. Attackers systematically randomized HTTP request headers and TLS connection parameters to circumvent JA3/JA4 signature filters, while deliberately probing for uncached paths—specifically dynamic HTTP 302 redirects served by the Python backend and high-entropy 404 endpoints—using oscillating traffic patterns designed to exploit rate-limiting windows. This incident highlights a critical vulnerability in modern application delivery: the compute asymmetry between CDN edge nodes and origin application servers. Attackers no longer rely exclusively on crude bandwidth exhaustion; instead, they conduct automated reconnaissance against application routing structures to find endpoints that bypass edge caches. When malicious traffic forces backend web servers to handle uncached routing or error generation, origin connection pools rapidly saturate. In auto-scaling environments, this dynamic triggers runaway infrastructure costs while failing to restore availability, turning elasticity into a financial liability. The mechanics of this attack align with the broader convergence of distributed scraping pipelines and residential proxy networks. As tools built for automated data harvesting and scraping leverage global proxy fleets, the boundary between hostile DDoS campaigns and aggressive scraping has blurred. Relying on default Web Application Firewall (WAF) rule sets or single-IP reputation lists is no longer adequate when malicious requests originate from thousands of legitimate internet service providers simultaneously. Perimeter defense must transition from static IP filtering to behavioral and contextual anomaly enforcement distributed across the network edge. In practice, network security and platform engineers must audit application-layer traffic surfaces to eliminate un-cached origin compute. Redirection rules, error handlers, and search routing should be decoupled from application servers and executed directly at the CDN or edge-compute layer using Infrastructure-as-Code. Rate limiting rules should be structured around multi-variable keys—such as ASN, target hostname, and heuristic risk scoring—rather than client IP alone. Additionally, implementing micro-caching on dynamic redirects and error responses ensures origin backends remain isolated during distributed application-layer storms.