What Is a DDoS Attack, and How Does It Take a Website Down?

A shopping app crashes during a flash sale and the first guess is always the same: "server overload, too much traffic." Sometimes that's true. Sometimes it's something else entirely — thousands of machines, most of them hijacked without their owners knowing, all hammering the same server at once until it simply gives up. That's a DDoS attack, and it's one of the oldest tricks in the hacker playbook, still very much in use today.

What a DDoS attack actually is

DDoS stands for Distributed Denial of Service. Strip away the acronym and it's a simple idea: flood a website or online service with so many fake requests that it can't keep up with the real ones. Genuine users trying to check out, log in, or just load a page get stuck behind a wall of junk traffic, and eventually the server either slows to a crawl or crashes outright.

The "distributed" part matters. A single computer sending requests, no matter how fast, can usually be blocked or ignored. So attackers use a botnet — a network of hundreds, thousands, sometimes millions of infected devices (old routers, unpatched security cameras, compromised laptops) that quietly take orders from an attacker without their owners ever noticing. Spread the attack across that many machines, each with its own IP address, and separating "real customer" from "attack traffic" becomes a genuinely hard problem.

How the flood actually works

Not every DDoS attack looks the same. Some simply try to exhaust a server's bandwidth with sheer volume. Others are subtler, targeting the application layer — repeatedly requesting the one page on a site that's expensive to generate, like a search result or a database query, so a relatively small amount of traffic still causes outsized damage.

A particularly nasty variant is the amplification attack. The attacker sends a small request to a public server (often a DNS server) but fakes the return address, putting the victim's address there instead. The server replies with a response many times larger than the original request, straight at the victim, who never asked for any of it. A botnet doing this at scale can generate attack traffic far beyond what its own machines could produce directly.

A DDoS attack rarely breaks in. It doesn't need to — it just needs to make sure nobody else can get through the door either.

Why this matters for India specifically

India's digital backbone — UPI payment rails, e-commerce platforms during sales like the Flipkart Big Billion Days or Amazon's Great Indian Festival, government portals handling exam registrations or tax filings — is exactly the kind of high-traffic, high-stakes target DDoS attacks thrive on. A genuine traffic spike during a festival sale and a deliberate DDoS attack can look identical from the outside, which is precisely why telling them apart matters: one is a scaling problem, the other is a security incident that needs a different response.

CERT-In (the Indian Computer Emergency Response Team, the government body that tracks and responds to cybersecurity incidents in the country) has repeatedly flagged DDoS activity against Indian banking and government infrastructure, and incidents involving hacktivist groups targeting Indian sites during periods of geopolitical tension aren't rare. For a country where digital payments and e-governance have become daily habits for hundreds of millions of people, keeping these services online isn't optional — it's infrastructure, the same as electricity or water.

How sites actually defend against it

No single trick stops a determined DDoS attack, but a combination of defenses makes most attacks a non-event rather than a crisis:

• Content Delivery Networks (CDNs) spread traffic across servers in many locations, so an attack aimed at one point gets absorbed rather than concentrated. (If you want the deeper mechanics, Code24 has covered how CDNs keep websites fast in detail.)
• Rate limiting caps how many requests a single source can make in a given window, which blunts the simplest flood attacks without blocking genuine users.
• Traffic scrubbing services sit in front of a website and filter out attack traffic before it ever reaches the real servers, passing through only what looks legitimate.
• Anycast routing lets the same IP address be served from multiple data centers at once, diluting an attack across a much wider surface area.

Most large Indian platforms already use some combination of these, often through cloud providers that bundle DDoS protection in by default. Smaller businesses and personal websites are usually the more exposed targets, simply because they haven't needed to think about it — until the day they do.

The practical takeaway

You're not going to stop a DDoS attack from your end as a regular internet user, but there's a quieter part you can play: keep your router's firmware updated, change default admin passwords on smart devices, and don't ignore the security cameras or IoT gadgets gathering dust on your home network. Every unpatched device sitting on the internet is a potential foot soldier in somebody else's botnet. The best defense against the next big attack is simply fewer machines available to be recruited into one.