Who we are and what is Mēris?

Mēris Botnet was the biggest shock for companies in the second decade. We made headlines when in 2021 we launched an attack on major services, setting a record with 21.8 million requests per second. Since then, news about us has been dropping pretty much daily. All protection services were terrified by our actions. It is not a coincidence they named us "Mēris", which means plague in Latvian. And for real, people feared and still fear us like a real plague. It is not just our power but also the number of devices in our botnet that felt like a full-blown epidemic. Our current achievements:

Mēris botnet operator — DDoS attack statistics

Cases

YouTube
Brought down one of the world's largest video platforms during peak hours. Millions of users couldn't access content for extended periods.
Instagram
Targeted Instagram's infrastructure causing widespread outages across multiple regions. Users experienced login failures and feed loading issues.
Steam
Successfully disrupted Steam's gaming platform services during peak traffic periods. Millions of gamers experienced connection failures and authentication issues.
Google
Targeted Google's search and cloud infrastructure causing global service disruptions. Users worldwide experienced search failures and Google Cloud service outages.
Cloudflare
Regularly brought down the world's largest CDN network for an entire week. Millions of websites relying on Cloudflare became inaccessible globally.

Protections we bypass

In theory — everything. In practice, here is what we bypass for a fact, and what our clients attack most often:

Qrator the best L7 protection on the planet

Honestly — the strongest application-layer protection in the world by filtering quality, and the only one that can cut attacks invisibly, without ever showing the user a challenge. Their WASM Challenge alone kills most bots on the market. We respect them. We also pushed a then-world-record 21.8M RPS straight through their pipeline into Yandex — the attack that made the whole industry take L7 floods seriously. We later beat that record ourselves eighteen-fold. Passive, JS Challenge, WASM Challenge, CAPTCHA: all bypassed.

Cloudflare the biggest name in the game

The world's largest CDN, protecting a fifth of the internet. Every plan from Free to Enterprise, every mode — UAM, JS Challenge, Managed Challenge, Bot Fight Mode, Turnstile, CAPTCHA. We regularly brought their own network down for an entire week; millions of sites behind them went with it.

DDoS-GuardSells itself as “unbypassable”. We disagree — Passive, JS Challenge and CAPTCHA all fall.
StormwallThe gaming-niche favourite (FiveM, Minecraft). Redirect, JS / JSA Challenge, CAPTCHA — and UDP for the game ports.

Also fully bypassed: Imperva · Akamai · Amazon CloudFront · Vercel · BlazingFast · Anubis · OVH · Path · G-Core — all modes. Details are one free test away.