What Is a CC Attack? Difference from DDoS and Protection

A CC attack (Challenge Collapsar) is an application-layer denial-of-service attack: attackers use many seemingly normal HTTP requests to repeatedly hit the most resource-heavy pages or endpoints (search, login, checkout, dynamic queries), draining the web server's and database's CPU, connections and memory until the site slows down or crashes.

How is a CC attack different from DDoS?

CC is essentially a form of DDoS; the difference is the layer and the signature:

• Different layer: classic DDoS usually exhausts bandwidth at the network layer; CC exhausts the server's processing capacity at the application layer (HTTP).
• Different traffic: DDoS is often huge and obvious; CC traffic may be modest, but every request is "expensive" and looks like a real user.
• Different difficulty: because CC mimics legitimate visits, naively banning by IP or volume easily harms real users — making it harder to stop.

For network-layer floods, see What is a DDoS attack.

How a CC attack works

Attackers control many bots or use proxy pools to mimic real browser behavior, deliberately hitting backend-heavy endpoints at high frequency. Since each request triggers database queries, computation and rendering, the server is quickly overwhelmed — large resource consumption at tiny attack cost, which is CC's appeal.

Why is CC hard to defend?

Its requests carry normal User-Agent, cookies and Referer, with reasonable access paths; a single request looks almost identical to a real user. A blunt rule like "ban any IP over N requests" easily blocks legitimate users behind NAT, proxies or CDN back-to-origin — blocking the attack while driving away customers.

How to protect against CC attacks

• Identify by real client IP: pass through the true visitor IP and analyze rate and behavior by real source — block only anomalies, never bluntly.
• Human verification: present a JS challenge / 5-second shield to suspicious sources — real people pass easily, scripts get stuck.
• Rate and concurrency limits: throttle per source and per endpoint.
• WAF rules: detect abnormal request signatures, malicious crawlers and automation tools.
• Caching and static delivery: serve cacheable content from the edge to reduce origin hits and blunt "expensive endpoint" attacks.

What if your site is under a CC attack?

Onboard to a high-defense CDN with application-layer CC protection, enable smart identification by real IP and human verification, cache hot endpoints, and hide the origin so it cannot be bypassed. CDN Doctor's smart CC defense identifies by real client IP and bans only abnormal sources — real users are unaffected — working together with WAF and edge caching. See What is a high-defense CDN.