The IoT botnet behind the some of the largest publicly recorded DDoS attacks is flooding its targets with HTTP traffic in Layer 7 attacks. The attacks were recorded prior to the release of the Mirai malware, which scans the public Internet for IoT devices guarded by weak or default credentials and corrals them into a giant botnet. Cloudflare said in its report that measuring HTTP requests per second is another indicator of the size of these attacks given the inbound bandwidth they generate against a targeted web server.
Source: https://threatpost.com/iot-botnet-uses-http-traffic-to-ddos-targets/121199/