On October 21, 2016, millions of people on the US East Coast couldn’t open Twitter, Netflix, Spotify, Reddit, PayPal, or Airbnb. None of those companies had a problem of their own: nearly all of them relied, without most users ever knowing it, on a single infrastructure company called Dyn. And behind Dyn’s outage wasn’t a group of hackers at a keyboard — it was hundreds of thousands of security cameras, home routers, and video recorders that never knew they were part of an attack.
Malware built for Minecraft servers
Mirai, the malware behind the attack, wasn’t born with the ambition to take down half the internet. Its creators originally designed it to attack rival Minecraft servers and DDoS-mitigation companies competing with their own “protection” business — the classic scheme of creating the problem to sell the solution. It got away from them: the code, far more powerful than it needed to be for that original goal, leaked publicly weeks before the attack on Dyn, and anyone could copy it and launch their own version.
How a router or a camera got recruited without anyone noticing
Mirai didn’t exploit any sophisticated vulnerability. It constantly scanned the entire internet looking for devices — routers, IP cameras, digital video recorders — still using their factory-default password, one their owner had never changed. With a list of just over 60 hardcoded username-and-password combinations, it broke into hundreds of thousands of home devices nobody had looked at or updated since the day they were plugged in.
The day Twitter, Netflix, and Spotify went down through no fault of their own
On October 21, 2016, that botnet — made of ordinary people’s devices, not attacker-owned machines — launched three waves of traffic against Dyn’s DNS servers. With DNS not working, no browser could translate “twitter.com” into the server’s real address: to the user, the site simply wouldn’t load, even though Twitter’s own servers were perfectly healthy on the other end.
What does this have to do with your WordPress?
- No single request looked like an attack. Each camera or router sent only a handful of requests, indistinguishable from a normal device — exactly why blocking IP by IP never stops a real botnet.
- The scale came from forgotten devices, not powerful machines. The same reason a WordPress plugin or theme left unupdated for years is a risk: nobody watches it, nobody updates it, and over time it becomes the way in.
- Nobody stopped Mirai by blocking addresses one at a time. It took layers that analyze aggregate traffic behavior, not each connection in isolation — the same idea behind any real defense against a modern DDoS.
Nearly a decade later, Mirai’s code still circulates in dozens of variants, and the number of cameras, routers, and connected “things” still running unchanged factory passwords has only grown. The lesson from that October 21, 2016 isn’t that botnets are unstoppable — it’s that no defense that only looks at one IP at a time can ever stop them, no matter where you look.