On Saturday 11 September 2021 at 04:15 UTC, a UDP reflection (NTP) targeted a online payments customer in the Middle East. The attack peaked at 178.2 Gbps and lasted 161 minutes. Traffic originated from 1442 autonomous systems in 48 countries, predominantly a Mirai-derived IoT botnet.
| Vector | UDP reflection (NTP) |
| Peak | 178.2 Gbps |
| Duration | 161 min |
| Time to mitigation | 0.813 s |
| Attack traffic reaching origin | 0.047% |
| Legitimate traffic challenged | 0.21% |
Timeline
The attack was preceded by a publicly announced sales event. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 30 points of presence.
What the customer saw
A brief increase in p99 latency of 135 ms during the first minute, then normal service.
Recommendations
- Enable log streaming to your SIEM for faster correlation.
- Review allow-listed partner ranges quarterly.
- Lower challenge thresholds on authentication endpoints during high-risk events.
Interesting that most attacks are under ten minutes. Our experience is similar.
Carpet bombing is nasty. Good to see a clear explanation of it.
Thanks! Yes — the risk score and its components are included in every log record.
Nice to read a vendor blog that admits what went wrong.
Verified good bots and allow-listed partners bypass challenges entirely.
Our auditors asked for exactly this kind of incident evidence under DORA.