On Friday 8 May 2026 at 09:39 UTC, a UDP reflection (NTP) targeted a online payments customer in Western Europe. The attack peaked at 54.4 Gbps and lasted 97 minutes. Traffic originated from 2737 autonomous systems in 79 countries, predominantly residential proxy networks.
| Vector | UDP reflection (NTP) |
| Peak | 54.4 Gbps |
| Duration | 97 min |
| Time to mitigation | 0.803 s |
| Attack traffic reaching origin | 0.009% |
| Legitimate traffic challenged | 0.05% |
Timeline
The attack was preceded by a publicly announced sales event. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 38 points of presence.
What the customer saw
A brief increase in p99 latency of 157 ms during the first minute, then normal service.
Recommendations
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable authenticated origin pulls.
- Enable log streaming to your SIEM for faster correlation.
Thanks — sharing this with our on-call team.
Great write-up. We saw almost the same pattern on our login endpoint last month.
Verified good bots and allow-listed partners bypass challenges entirely.
The point about origin IPs leaking through certificate transparency logs is underrated.