GreatFire experiencing severe DDoS attacks, with 2.6B requests/hour, 2,500 times normal levels, affecting all mirror sites
We are under attack — We are under attack and we need help. Likely in response to a recent story in the Wall Street Journal (WSJ), we've experienced …
Context & Ripple Effects
GreatFire runs mirror sites that let users inside China reach blocked news sources, and its disclosure that the flood is 'likely' a response to a Wall Street Journal story puts censorship enforcement and Western media coverage on a collision course. The timing matters: the DDoS campaign against GitHub began the same week, suggesting one coordinated operation rather than an isolated hit.
Within days GreatFire would publish its own forensic analysis naming China as the source of both attacks, turning a traffic incident into an attribution fight — with Baidu publicly denying any role in the GitHub flood.
First-order effects
- All of GreatFire's mirror sites are degraded or unreachable under ~2.6 billion requests per hour — roughly 2,500 times normal load — cutting off the primary access route to uncensored reporting for users behind China's firewall.
- GitHub, absorbing the same attack pattern concurrently, has to divert engineering capacity to mitigation while its platform hosts some of the anti-censorship code the campaign targets.
Second-order effects
- Hosting and CDN providers behind both targets are forced to absorb state-scale junk traffic at their own expense, sharpening the question of who pays when a censorship action is laundered through third-party infrastructure.
- Attribution becomes the counter-move: by publishing technical evidence pointing at China, GreatFire shifts the battleground from uptime to diplomatic and press scrutiny, pressuring companies like Baidu to issue denials just to protect commercial reputations abroad.
Third-order effects
- If politically motivated floods of this scale become routine, independent publishers will need commercial-grade mitigation they cannot afford alone — a dependency that concentrates anti-censorship infrastructure in a handful of large networks, as later records from the Krebs takedown through Cloudflare's multi-Tbps mitigations show the volume curve only steepening.
The trend: State-linked DDoS campaigns are evolving from temporary nuisances against dissident sites into sustained censorship tools, driving a decade-long arms race toward ever-larger volumetric attacks and ever-fewer providers capable of absorbing them.