How DDoS Attacks Use IP Addresses: Botnets, Spoofing and Traffic Flooding Explained

A Distributed Denial-of-Service, or DDoS, attack attempts to make a website, server or network service unavailable by overwhelming it with traffic or requests.

However, the IP address plays several different roles during a DDoS attack.

There may be:

• a target IP address receiving the traffic,
• thousands of botnet IP addresses sending requests,
• spoofed source IP addresses that do not identify the true sender,
• and third-party systems acting as reflectors or amplifiers.

Therefore, looking at a DDoS attack as simply:

“Many bad IP addresses attacking one server”

is often too simplistic.

The more useful question is:

Where is the traffic really coming from, which IP addresses are genuine, and how is the attacker using Internet infrastructure to increase the attack volume?

ENISA continues to classify DDoS as a major threat against service availability. In its 2025 threat landscape, DDoS represented 77% of the incidents in the analysed dataset, although ENISA also noted that many hacktivist DDoS incidents were short-lived and had limited operational impact.

For a broader look at current attack trends, see LARUS.Foundation's guide to Cybersecurity Threats.

What Is a DDoS Attack?

A DDoS attack occurs when multiple systems send traffic or requests toward the same target in an attempt to exhaust its resources.

The target may be:

• a website,
• an API,
• a DNS service,
• a game server,
• a cloud application,
• a public IP address,
• or an entire network.

A simple attack path may look like this:

Many attacking devices
↓
Internet
↓
Target IP address
↓
Network or server becomes overloaded
↓
Legitimate users cannot connect

CISA explains that DDoS attacks occur when traffic originates from multiple attacking machines working together, often through botnets made up of compromised Internet-connected devices.

The important point is that DDoS primarily attacks availability.

The objective is usually not:

steal one file.

Instead, it is:

make the service difficult or impossible for legitimate users to reach.

How Do IP Addresses Work in a DDoS Attack?

Every Internet packet normally contains information identifying:

• where the packet came from,
• and where it is going.

These are represented by source and destination IP addresses.

A simplified packet looks like:

During a normal connection:

Source IP: legitimate user
Destination IP: website or service

During a DDoS attack:

Source IP: attacker-controlled or compromised device
Destination IP: target service

However, things become more complicated when attackers use:

• botnets,
• source IP spoofing,
• reflection,
• or amplification.

Therefore, defenders cannot always assume that the source IP visible in a packet identifies the real attacker.

How Botnets Use IP Addresses in DDoS Attacks

A botnet is a group of compromised devices controlled by an attacker.

These devices can include:

• PCs,
• servers,
• routers,
• cameras,
• IoT devices,
• or other Internet-connected systems.

CISA notes that DDoS attackers frequently use botnets containing hijacked Internet-connected devices, including IoT devices with weak security or default credentials.

A simplified botnet attack looks like:

Attacker
↓
Botnet command system
↓
Bot 1 — IP A
Bot 2 — IP B
Bot 3 — IP C
Bot 4 — IP D
↓
Target IP

The important characteristic is distribution.

Instead of one computer sending all the traffic, thousands of devices may send smaller amounts simultaneously.

As a result, the target sees requests arriving from many source IP addresses.

Why This Makes Blocking Harder

Suppose a website receives malicious traffic from:

198.51.100.10
198.51.100.11
198.51.100.12
198.51.100.13

Blocking four IP addresses is simple.

Now imagine the traffic comes from:

50,000 compromised devices across many ISPs and countries.

Blocking individual IP addresses becomes much less practical.

Moreover, some compromised devices may belong to ordinary users who do not know their systems are participating in a botnet.

Therefore:

A malicious source IP in a botnet may identify a compromised device, not the person controlling the attack.

This distinction is important for cyberattack attribution.

What Is IP Spoofing in a DDoS Attack?

IP spoofing occurs when an attacker deliberately places a false source IP address into a packet.

Normally:

Source IP: Attacker
Destination IP: Target

With spoofing:

Source IP: Forged address
Destination IP: Target

The receiving system sees the forged source address instead of the attacker's true source address.

Cloudflare compares this to forging the return address on a letter.

However, IP spoofing does not mean that the attacker owns, controls or has transferred the spoofed IP address.

It only means that the packet's source field has been falsified.

That distinction matters because IP spoofing, IP hijacking and IP ownership are different concepts.

IP Spoofing vs BGP Hijacking

Therefore, seeing a spoofed packet does not mean that the attacker's network has legitimately obtained that IP block.

It means the packet has been created with misleading source information.

How Reflection Attacks Use a Victim's IP Address

Reflection attacks make source IP spoofing much more powerful.

The attacker does not send all traffic directly to the victim.

Instead, the attacker sends requests to third-party servers and places the victim's IP address in the source field.

The flow looks like:

Attacker
↓
sends request with spoofed source IP
↓
Third-party server
↓
believes victim sent request
↓
sends response
↓
Victim's IP address

The third-party server is not necessarily malicious.

It may simply be responding normally to what appears to be a legitimate request.

CISA describes reflection amplification attacks in this way: a threat actor uses a third-party server as an intermediary, while the spoofed source address causes responses to be sent toward the victim.

This is why reflection is a good example of how IP addresses can be abused as identifiers inside network protocols.

What Is DDoS Amplification?

Amplification makes reflection attacks even more powerful.

The attacker sends a relatively small request.

The third-party server returns a much larger response.

For example:

Small request
↓
Amplifier server
↓
Much larger response
↓
Victim

CISA notes that some UDP-based services can generate responses many times larger than the original request.

The attack therefore uses two mechanisms together:

Reflection

The response is redirected toward the victim through a spoofed source IP.

Amplification

The response is larger than the request.

Combined:

Small spoofed requests
↓
Many third-party servers
↓
Large responses
↓
Target IP flooded

Practical Example: DNS Amplification Attack

DNS is a common way to explain reflection and amplification.

Suppose an attacker wants to overwhelm:

Target IP: 203.0.113.50

Instead of sending requests directly to the target, the attacker sends requests to open DNS resolvers.

However, the attacker changes the source address of each request to:

203.0.113.50

The DNS servers believe that IP requested the information.

Therefore, they send their responses to:

203.0.113.50

The attack path becomes:

Attacker
↓
Spoofs target IP
↓
Many DNS resolvers
↓
Send large DNS responses
↓
Target receives unwanted traffic

Cloudflare describes DNS amplification as a reflection-based volumetric DDoS attack in which open DNS resolvers send amplified traffic to the spoofed victim address.

The important point is:

The DNS resolver's IP address appears in the victim's traffic logs, but the DNS operator may not be the attacker.

The resolver may simply have been abused as part of the reflection infrastructure.

Botnet DDoS vs Reflection DDoS

These attack models are related, but they are not identical.

In practice, attackers may combine techniques.

Therefore, DDoS defence must look at traffic patterns, not simply individual IP addresses.

Why Blocking One IP Address Usually Does Not Stop DDoS

IP blocking can still be useful.

For example, if one source repeatedly sends obviously malicious requests, blocking that source may reduce unwanted traffic.

However, DDoS attacks are designed to make this approach difficult.

Possible reasons include:

• thousands of source IPs,
• constantly changing botnet devices,
• spoofed source IP addresses,
• legitimate servers being abused as reflectors,
• distributed cloud infrastructure,
• high traffic volumes arriving before the application layer.

Therefore:

Blocking one IP solves one source, while DDoS is usually a distributed traffic problem.

A defender needs to identify broader characteristics such as:

• packet rate,
• request rate,
• protocol,
• geographic distribution,
• ASN distribution,
• ports,
• abnormal connection behaviour,
• repeated request patterns,
• sudden changes from normal traffic.

What Network Defenders Look At During a DDoS Attack

During an attack, defenders may examine several signals.

However, these signals must be interpreted carefully.

For example:

A large number of packets from one country does not prove that attackers are physically located there.

The traffic may come from:

• compromised devices,
• cloud servers,
• VPNs,
• proxies,
• or reflection infrastructure.

Therefore, IP information is useful for traffic analysis, but not always sufficient for attacker attribution.

Network-Layer vs Application-Layer DDoS

Not all DDoS attacks target the same resources.

Microsoft notes that many DDoS attacks target Layer 3 and Layer 4 resources by flooding network interfaces or services with traffic.

Application-layer attacks can be different.

For example:

Normal user

GET /product/123

Attacker-controlled bots

GET /product/123
GET /search
GET /login
GET /api

If enough bots repeatedly request expensive resources, the application may become overwhelmed even if the raw bandwidth is not extremely high.

Therefore, DDoS mitigation needs to match the attack layer.

Why DDoS Is an Availability and Infrastructure Problem

A DDoS attack may begin with packets.

However, the real failure can spread further.

For example:

Target IP flooded
↓
Network link congested
↓
Website unavailable
↓
API stops responding
↓
Customers cannot complete transactions
↓
Business operations affected

Therefore, the true risk is not simply:

too many packets.

It is:

loss of service availability.

This is why ENISA classifies DDoS under threats against availability.

A short attack against a non-critical website may have limited impact.

However, an attack against:

• DNS,
• financial services,
• public administration,
• telecommunications,
• cloud infrastructure,
• healthcare systems,

can have wider operational consequences.

How Can Organisations Reduce DDoS Risk?

There is no single control that stops every DDoS attack.

Instead, organisations typically use multiple layers.

1. Use Upstream DDoS Mitigation

Large volumetric attacks may exceed the capacity of the victim's own Internet connection.

Therefore, mitigation often needs to happen before the traffic reaches the target network.

This may involve:

• ISP filtering,
• cloud DDoS protection,
• scrubbing centres,
• CDN networks,
• Anycast infrastructure.

2. Use Anycast Where Appropriate

Anycast allows the same IP address to be announced from multiple network locations.

As a result, traffic can be distributed across different sites rather than concentrated on one server or data centre.

This does not automatically stop DDoS.

However, it can increase the infrastructure available to absorb traffic.

3. Rate-Limit Abnormal Requests

Rate limiting restricts how many requests a client can make within a period.

For example:

Normal user:
20 requests/minute

Abnormal source:
5,000 requests/minute

The application or edge system may limit the abnormal traffic.

However, distributed botnets can make simple per-IP rate limits less effective because each bot may stay below the individual threshold.

4. Filter Spoofed Traffic

One of the most important long-term defences against reflection attacks is preventing spoofed traffic from leaving networks.

Cloudflare and CISA both identify source-address validation or filtering as an important countermeasure against spoofing-based amplification attacks.

Conceptually:

Packet leaves customer network

Source IP belongs to customer network?
→ Yes → allow

Source IP claims to come from somewhere else?
→ suspicious → drop

If more networks prevent spoofed traffic from leaving their infrastructure, reflection attacks become harder to launch.

5. Monitor Traffic Baselines

Defenders need to know what normal traffic looks like.

For example:

Normal

200 Mbps
10,000 requests/minute
Typical traffic from 20 countries

Attack

5 Gbps
500,000 requests/minute
Sudden traffic from thousands of IPs

Without a baseline, it is harder to identify abnormal behaviour quickly.

Can You Trace a DDoS Attack Using IP Addresses?

Sometimes partially.

IP addresses can help defenders identify:

• networks generating traffic,
• botnet clusters,
• hosting providers,
• abused reflectors,
• source ASNs,
• repeated malicious behaviour.

However, an IP address alone does not necessarily identify the attacker.

For example:

Visible IP

may represent:

• compromised home router,
• infected IoT camera,
• cloud server,
• proxy,
• VPN exit,
• reflector,
• NAT gateway.

Therefore:

DDoS source IP attribution is not the same as human attribution.

This is particularly important in reflection attacks because the IP address visible to the victim may belong to a legitimate server that is being abused.

DDoS vs DoS

The word distributed is therefore critical.

It describes why DDoS is more difficult to handle using simple IP blocking.

Practical DDoS Defence Checklist

Before an attack:

• Know which public IP addresses host critical services.
• Understand normal bandwidth and request patterns.
• Identify your ISP or upstream DDoS response process.
• Use DDoS protection for critical public services.
• Protect DNS infrastructure.
• Apply rate limits where appropriate.
• Monitor abnormal traffic patterns.
• Keep incident-response contacts ready.
• Review whether network devices can handle abnormal packet rates.
• Test failover and recovery processes.
• Avoid relying on one firewall as the only defence.

During an attack:

• Identify the target IP and service.
• Determine whether the attack is volumetric or application-layer.
• Review source IP and ASN distribution.
• Check whether IP spoofing or reflection appears involved.
• Contact upstream providers early.
• Avoid blocking legitimate traffic unnecessarily.
• Preserve traffic logs for later analysis.

Ultimately, DDoS response is not simply:

Find bad IP → block bad IP.

It is a process of understanding traffic behaviour, infrastructure capacity and attack distribution.

Conclusion

IP addresses are central to how DDoS attacks are delivered and analysed, but their role is more complex than simply identifying the attacker.

A direct botnet attack may involve thousands of compromised devices, each with its own public IP address.

Meanwhile, a reflection attack may use the victim's IP address as a forged source so that legitimate third-party systems send responses toward the target.

The attack path can therefore look like:

Attacker
→ Botnet or spoofed traffic
→ Internet infrastructure
→ Target IP
→ Network congestion
→ Service disruption

This is why defenders should not rely on individual IP blocking alone.

Instead, effective DDoS resilience combines:

• traffic analysis,
• upstream mitigation,
• source-address filtering,
• rate limiting,
• distributed infrastructure,
• capacity planning,
• and incident response.

Most importantly:

An IP address seen during a DDoS attack may identify a traffic source, a compromised device or a reflector—but not necessarily the person controlling the attack.

Understanding that distinction makes DDoS traffic easier to analyse and helps organisations respond based on network behaviour rather than assumptions.

Frequently Asked Questions

1. What is a DDoS attack?

A Distributed Denial-of-Service attack attempts to make a service unavailable by sending traffic or requests from many systems toward the same target.

2. How are IP addresses used in DDoS attacks?

IP addresses identify traffic sources and destinations. Attackers may use real botnet IP addresses, spoof source IP addresses or abuse third-party servers to send traffic toward a target IP.

3. What is IP spoofing in DDoS?

IP spoofing means placing a forged source IP address inside network packets. In reflection attacks, attackers commonly spoof the victim's IP address so third-party servers send their responses toward the victim.

4. What is a DDoS botnet?

A DDoS botnet is a collection of compromised Internet-connected devices that an attacker controls and uses to send traffic toward a target.

5. Can blocking an IP address stop DDoS?

Blocking individual IP addresses can help in some situations, but it is usually insufficient against a large distributed attack involving thousands of sources or spoofed traffic.

6. What is a reflection DDoS attack?

A reflection attack occurs when an attacker sends requests to third-party systems using the victim's IP address as the spoofed source. The third-party systems then send their responses to the victim.

7. What is amplification in DDoS?

Amplification occurs when a small attacker request causes a third-party system to send a much larger response toward the victim. Reflection and amplification are often combined.

8. Why is UDP commonly associated with amplification attacks?

UDP is connectionless and does not inherently validate that the source IP address actually belongs to the sender. Therefore, certain UDP-based services can be abused with spoofed source addresses if other protections are not in place.

9. Does a malicious IP address identify the attacker?

Not necessarily. The IP may belong to a compromised botnet device, proxy, VPN, cloud server or legitimate reflector. IP evidence should therefore be interpreted together with other network and security data.

10. Can IPv6 be used in DDoS attacks?

Yes. DDoS is not limited to IPv4. Systems reachable over IPv6 can also be targeted by denial-of-service traffic, although attack techniques and network controls may differ depending on the environment.

References

1. CISA, FBI & MS-ISAC — Understanding and Responding to Distributed Denial-of-Service Attacks

https://www.cisa.gov/sites/default/files/publications/understanding-and-responding-to-ddos-attacks_508c.pdf

2. CISA — UDP-Based Amplification Attacks

https://www.cisa.gov/ncas/alerts/ta14-017a

3. Cloudflare — DNS Amplification DDoS Attack
https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/

4. Cloudflare — What Is an IP Stresser? DDoS Booters
https://www.cloudflare.com/en-gb/learning/ddos/ddos-attack-tools/ddos-booter-ip-stresser/

5. Microsoft — Denial-of-Service Defense Strategy
https://learn.microsoft.com/en-us/compliance/assurance/assurance-microsoft-dos-defense-strategy

6. Microsoft Security — What Is a DDoS Attack?
https://www.microsoft.com/en-us/security/business/security-101/what-is-a-ddos-attack