A public web portal becomes unreachable. Logs show completed TCP handshakes and full HTTP requests arriving at the same moment from thousands of residential IP addresses in many countries, and adding the busiest addresses to a deny list has no visible effect. Which attack is occurring, and why does the deny list fail?

A distributed denial-of-service attack exhausts a target's capacity using many compromised systems, typically a botnet of infected home routers, cameras, and PCs. Because each bot is a genuine host with its own address, the attack completes TCP handshakes and sends valid-looking HTTP requests, which makes it an application-layer flood. Blocking individual sources fails because the pool is large, geographically spread, and replaced faster than a manual list can grow; mitigation relies on upstream scrubbing, rate limiting, behavioral detection, and content delivery networks that absorb volume. A single-source DoS with spoofed addresses is ruled out because spoofed sources cannot complete a TCP three-way handshake, since the SYN-ACK goes to the forged address. A man-in-the-middle attack intercepts and relays a victim's session for eavesdropping or tampering; it does not make the service unreachable through volume. A DNS reflection attack sends UDP responses from open resolvers, not completed HTTP sessions from residential clients. Exam caveat: distinguish volumetric, protocol, and application-layer floods by what the logs show. Operational check: confirm whether sources complete handshakes, measure distinct source counts over time, and engage upstream DDoS protection rather than growing a local deny list.