On Thursday 30 September 2021 at 08:53 UTC, a UDP reflection (NTP) targeted a B2B SaaS customer in Western Europe. The attack peaked at 228.7 Gbps and lasted 137 minutes. Traffic originated from 4053 autonomous systems in 53 countries, predominantly hijacked home routers.
| Vector | UDP reflection (NTP) |
| Peak | 228.7 Gbps |
| Duration | 137 min |
| Time to mitigation | 0.167 s |
| Attack traffic reaching origin | 0.074% |
| Legitimate traffic challenged | 0.59% |
Timeline
The attack was preceded by no stated motive. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 37 points of presence.
What the customer saw
The customer’s status page stayed green throughout; they learned about the attack from our notification.
Recommendations
- Enable log streaming to your SIEM for faster correlation.
- Review allow-listed partner ranges quarterly.
- Keep origin IPs out of public DNS history.