On Tuesday 11 January 2022 at 12:50 UTC, a UDP reflection (NTP) targeted a gaming community customer in the Nordics. The attack peaked at 219.3 Gbps and lasted 57 minutes. Traffic originated from 2476 autonomous systems in 41 countries, predominantly a headless-browser farm.
| Vector | UDP reflection (NTP) |
| Peak | 219.3 Gbps |
| Duration | 57 min |
| Time to mitigation | 0.460 s |
| Attack traffic reaching origin | 0.039% |
| Legitimate traffic challenged | 0.70% |
Timeline
The attack was preceded by no stated motive. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 30 points of presence.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Review allow-listed partner ranges quarterly.
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable log streaming to your SIEM for faster correlation.
Clear and practical, thanks.
Clear and practical, thanks.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Good question. We will cover that in a follow-up post.
Thanks — sharing this with our on-call team.
Great to hear, thanks for sharing your experience.
Would love a follow-up on how you handle HTTP/3 fingerprinting.