What is Mēris Botnet?

Mēris is one of the most famous DDoS botnets in internet history — and the engine behind our DDoS-for-Hire service. The name comes from the Latvian word for “plague”, and it earned that name honestly: at its peak, the botnet held hundreds of thousands of infected devices worldwide and battered some of the largest platforms on the planet.

The 2021 records

Mēris became headline news in the summer of 2021. In August, Cloudflare mitigated an attack peaking at 17.2 million requests per second — the largest HTTP DDoS attack it had ever seen at that point (Cloudflare, “A Brief History of the Meris Botnet”). Weeks later, Yandex reported an even bigger wave: 21.8 million RPS, a new world record for application-layer attacks, documented by Qrator Labs and BleepingComputer. Even KrebsOnSecurity ended up on the receiving end — for months afterwards, protection vendors measured their defences against one question: “will it survive Mēris?”

And the records did not stop in 2021. In October 2023 Google mitigated an attack peaking at 398 million RPS using a then-novel technique — HTTP/2 Rapid Reset (Google Cloud writeup). The technique received its own CVE — CVE-2023-44487. As readers of this blog can guess, we did not just pioneer it — we invented it in our swarm; the imitators came later. Our current Layer 7 capacity exceeds 400 million requests per second; the full timeline with screenshots lives on the achievements page.

How the botnet works

Mēris is built from a huge fleet of compromised devices — estimates range from 56 000 to 250 000 routers and IoT boxes enlisted into the swarm, largely MikroTik hardware (with some Linksys alongside) exploited through CVE-2018-14847 and SSH password bruteforce. Analysts traced the supply of infected devices back to the Glupteba botnet as early as 2018 — by the time anyone noticed the swarm, it already spanned every continent. Unlike classic Layer 4 floods that simply saturate bandwidth, Mēris specialises in Layer 7 HTTP floods: requests look legitimate, arrive over proper TCP connections and use techniques such as HTTP pipelining and HTTP/2 stream multiplexing to multiply their impact. That is why “just enable a CDN” was never enough — filtering required real engineering, not a checkbox.

• 400M+ RPS available L7 attack power
• 10+ Tbps available L4 attack power
• Attack techniques notable enough to receive their own CVE
• Global botnet presence on every continent

From botnet to professional service

Today Mēris operates as a professional DDoS-for-Hire and stress testing service. Companies use us to verify that their infrastructure, firewalls and anti-DDoS setups actually hold up — and sometimes to level the playing field when competitors play dirty. We work 24/7, provide free test attacks before payment and back every order with the same firepower that made the records.

Want to see what a real botnet looks like up close? Check the main page, browse the cases, or request a free stress test.