On Friday 8 April 2022 at 09:10 UTC, a UDP reflection (NTP) targeted a online casino customer in the Middle East. The attack peaked at 179.7 Gbps and lasted 89 minutes. Traffic originated from 2352 autonomous systems in 93 countries, predominantly misconfigured open reflectors.
| Vector | UDP reflection (NTP) |
| Peak | 179.7 Gbps |
| Duration | 89 min |
| Time to mitigation | 0.259 s |
| Attack traffic reaching origin | 0.090% |
| Legitimate traffic challenged | 0.57% |
Timeline
The attack was preceded by a ransom note demanding payment in Monero. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 36 points of presence.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Review allow-listed partner ranges quarterly.
- Enable authenticated origin pulls.
The billing model is what got our finance team on board, honestly.
Do you publish the edge IP ranges in a machine-readable format?
Solid runbook advice. The DNS-at-2am point hit home.
Would love a follow-up on how you handle HTTP/3 fingerprinting.