incident · 1363564800000

Spamhaus DDoS Attack

The Spamhaus Project, a non-profit organization tracking spam, was hit by one of the largest Distributed Denial of Service (DDoS) attacks recorded at the time, reaching 300 Gbps.

What happened

Following Spamhaus's decision to blacklist Cyberbunker, a Dutch web host, massive DDoS attacks were launched against Spamhaus's infrastructure. The attackers used DNS amplification to generate traffic peaking at 300 Gbps.

Technical mechanism

The attackers utilized DNS amplification, sending requests with spoofed IP addresses to open DNS resolvers, which then sent much larger responses to the target, overwhelming its bandwidth.

Why it matters

The attack highlighted the increasing scale and impact of DDoS attacks using DNS reflection, causing noticeable congestion on the global internet.

Impact

The attack caused significant disruption to Spamhaus's services and reportedly slowed down internet speeds in parts of Europe due to the sheer volume of traffic.

Response

Spamhaus enlisted the help of Cloudflare to mitigate the attack. Cloudflare absorbed the traffic by distributing it across its global network.

Defensive lessons

  • Implement BCP 38 to prevent IP spoofing
  • Secure open DNS resolvers to prevent their use in amplification attacks
  • Utilize Anycast and distributed mitigation services for DDoS protection

Evidence register

  1. Cloudflare — The DDoS That Almost Broke the Internet (verified)