On Monday 12 December 2022 at 09:09 UTC, a UDP reflection (DNS) targeted a online payments customer in the UK. The attack peaked at 386.3 Gbps and lasted 29 minutes. Traffic originated from 2480 autonomous systems in 63 countries, predominantly hijacked home routers.
| Vector | UDP reflection (DNS) |
| Peak | 386.3 Gbps |
| Duration | 29 min |
| Time to mitigation | 0.301 s |
| Attack traffic reaching origin | 0.067% |
| Legitimate traffic challenged | 0.76% |
Timeline
The attack was preceded by a competitor’s product launch. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 38 points of presence.
What the customer saw
The customer’s status page stayed green throughout; they learned about the attack from our notification.
Recommendations
- Add a dedicated rate limit for the targeted route.
- Review allow-listed partner ranges quarterly.
- Enable authenticated origin pulls.
Great write-up. We saw almost the same pattern on our login endpoint last month.
The point about origin IPs leaking through certificate transparency logs is underrated.
Could you share the dataset behind the percentages?
The billing model is what got our finance team on board, honestly.
Machine-readable ranges are at /ips.json and via the API.
Our auditors asked for exactly this kind of incident evidence under DORA.
Carpet bombing is nasty. Good to see a clear explanation of it.
Our auditors asked for exactly this kind of incident evidence under DORA.
Great write-up. We saw almost the same pattern on our login endpoint last month.