If your site "isn't seeing much traffic, but it just won't load" — and your firewall log is full of requests that look perfectly normal — you are probably facing a CC attack.
CC (Challenge Collapsar) attacks are the most deceptive member of the DDoS family. They do not need Tbps of bandwidth. A few hundred infected machines and a few thousand connections are enough to take down a site that lacks application-layer defenses.
How a CC attack works
The name comes from an early attack tool called "Challenge Collapsar." The core idea is brutally simple:
Continuously request the pages on your site that consume the most server resources.
Examples:
- Search endpoints that query the database
- Report pages that require heavy computation
- Download endpoints that read large files
- Submission endpoints that write frequently
Attackers use large pools of proxy IPs to hit these endpoints simultaneously and repeatedly. Each individual request looks legitimate — but your CPU, database connection pool, and backend services are drained within minutes.
The key insight: a CC attack targets resource consumption, not bandwidth. This is why simply buying more bandwidth or a high-defense IP does almost nothing against it.
CC attacks vs. traditional DDoS
| Dimension | Volumetric DDoS | CC attack |
|---|---|---|
| Layer | L3 / L4 (network, transport) | L7 (application) |
| Traffic scale | Hundreds of Gbps to Tbps | Sometimes only a few Mbps |
| Request signature | Obviously malformed packets | Nearly identical to real users |
| Resource targeted | Bandwidth, connection table | CPU, memory, database, backend |
| Defense method | Bandwidth scrubbing, rate limiting | Behavior analysis, bot challenges, precise throttling |
| Detection difficulty | Relatively easy | Extremely hard |
In one sentence: volumetric DDoS floods your house; a CC attack sends spies inside to use up all your water and electricity.
Why CC attacks are so hard to stop
Three reasons:
- The traffic is too small to trigger alarms. Most monitoring systems set alert thresholds by bandwidth. A CC attack may not even match your normal peak traffic.
- The requests are legitimate. Attackers request pages that genuinely exist, with valid parameters. There is nothing malformed to detect.
- Sources are distributed and disguised. Attackers use large pools of real proxy IPs and even mimic real browser User-Agents and cookies — simple blocklists fail completely.
A four-layer defense strategy
Layer 1: Resource isolation
First, make sure the attack cannot reach anything critical:
- Separate resource-heavy endpoints (search, reports, exports) from core business endpoints
- Add caching so identical queries return cached results without touching the database
- Set per-IP concurrency limits to raise the attacker's cost
Layer 2: Precise throttling and rate baselines
Do not apply uniform rate limits. The right approach:
- Establish a normal traffic baseline per endpoint (QPS, response time, request signature)
- Auto-degrade when traffic deviates from baseline (queue, serve cache, require verification)
- Apply stricter policies specifically to login and submission endpoints
Layer 3: Bot challenges
For high-value endpoints that must be protected, add verification:
- JS challenges (clients must execute a computation — proxy pools struggle to pass)
- Behavioral fingerprinting (mouse movement, click cadence, browser fingerprint)
- CAPTCHA where necessary
The trade-off: verification affects user experience. Enable it during attacks or on high-risk endpoints only, not site-wide by default.
Layer 4: Professional scrubbing with expert intervention
CC attacks usually require real-time policy adjustment to suppress — attackers observe your rules and adapt. This is exactly where a professional protection service earns its keep.
AwayDDoS's deep cleaning layer continuously models application-layer behavior, and our 7×24 security experts actively intervene to tune rules during an attack rather than waiting for your ticket. See Protection Solutions for details.
A common misconception
"I put a CDN in front, so I'm safe from CC." — A CDN mitigates some of it, but CDN caching policies typically bypass dynamic requests — which are precisely the endpoints CC attacks target. What you actually need is deep application-layer behavior analysis.
Key takeaways
What makes CC attacks dangerous is that they are extremely cheap and extremely hard to identify. Defending against them is not about buying more bandwidth — it is about building depth: resource isolation, precise throttling, bot challenges, and expert intervention working together.
If your site shows the pattern of "low traffic but persistently unreachable," contact us now for a free attack-signature analysis. New to the topic? Start with What Is a DDoS Attack? A Complete Beginner's Guide.