NTP amplification reflector distribution, SYN flood source analysis, the FlowSpec rules that fired, PCAP forensics, and a second-by-second timeline of the March 27 Lorikeet Security incident....
Apr 26, 2026 · 15 min read →Blog
Attack postmortems.
Engineering deep-dives.
Practical guides from engineers who've been DDoS'd and learned from it.
All
Case Study
Post-Mortem
Attack Analysis
Original Research
Engineering
Forensics
Integrations
Mitigations
Fundamentals
Tools
Comparisons
Get attack analysis in your inbox
Monthly postmortems, detection techniques, and original research. No fluff.
Post-Mortem
We stopped a 48 Gbps attack during a live event: full technical breakdown
Post-Mortem
OVHcloud 2024: 840 million packets per second and the MikroTik problem
How compromised MikroTik routers were weaponized for packet-rate attacks peaking at 840 Mpps, why PPS matters more than bandwidth, and what ...
Mar 16, 2026 · 13 min read →
Post-Mortem
HTTP/2 Rapid Reset: the zero-day that hit 398M requests per second
CVE-2023-44487 exploited HTTP/2 stream multiplexing to generate the largest application-layer DDoS ever recorded. Three of the world's bigge...
Mar 15, 2026 · 13 min read →
Post-Mortem
AWS 2020: dissecting the 2.3 Tbps CLDAP reflection attack
A technical post-mortem of the February 2020 CLDAP reflection attack: 2.3 Tbps of amplified traffic via UDP port 389 and the protocol mechan...
Mar 15, 2026 · 12 min read →
Post-Mortem
GitHub 2018: inside the 1.35 Tbps memcached DDoS that changed everything
How a 15-byte UDP request to exposed memcached servers generated 1.35 Tbps of amplified traffic, no botnet required. The attack that forced ...
Mar 14, 2026 · 14 min read →
Post-Mortem
Dyn 2016: how 100,000 IoT devices took down half the internet
Three waves of DNS query floods from a Mirai botnet brought Dyn's managed DNS to its knees, taking Twitter, Netflix, Reddit, and Spotify off...
Mar 14, 2026 · 15 min read →