It was the largest online attack ever reported. Over the course of the past week, servers belonging to an international non-profit company called The Spamhaus Project, which fights email spammers, were inundated with up to 38 gigabytes of traffic each second, New Scientist reports.

The attackers exploited open domain name server (DNS) resolvers, faking their own IP addresses, replacing them with the address of the target. This technique, called IP spoofing, results in a torrent of the DNS responses all flooding into the target at once.

Mike Smith, director of the customer security internet response team at Akamai in Cambridge, Massachusetts, says he has been dealing with a hole in web-based content-management systems like WordPress and Joomla that lets attackers use other companies’ hosting platforms to launch their attacks.

Because company servers have faster Internet connections than home computers, the infected software — which forms a network known as the BroBot — can be taken over and made to launch highly powerful attacks.