Attack Analysis
How to detect Mirai C2 traffic on bare metal
Mirai botnet traffic has distinct fingerprints in kernel counters and packet logs. Spot scanning, C2 command t...
9 min read →Blog
Attack postmortems.
Engineering deep-dives.
Practical guides from engineers who've been DDoS'd and learned from it.
All
Post-Mortem
Attack Analysis
Engineering
Forensics
Integrations
Mitigations
Fundamentals
Tools
Comparisons
Attack Analysis
The 10 largest DDoS attacks in history (and what we learned)
From the 300 Gbps Spamhaus attack to 5.6 Tbps Mirai variants — the biggest DDoS attacks ever recorded, what made them possible, and the defenses they forced into existence.
Attack Analysis
Memcached amplification: detection, evidence & what to tell your upstream
The 50,000x amplification factor explained at the packet level, a ready-to-use NOC email template, and the exa...
10 min read →Attack Analysis
DNS amplification attacks: detection, analysis & mitigation
Complete guide to DNS amplification DDoS attacks. Learn how they work at the protocol level, what the traffic ...
12 min read →Attack Analysis
Detecting memcached amplification before it hits 1Tbps
memcached amplification attacks can reach 50,000x amplification. Here's exactly what the traffic looks like at...
8 min read →Attack Analysis
Multi-vector DDoS: why your single-protocol detection fails
Sophisticated attackers don't use one protocol. They rotate between UDP, TCP, and HTTP to evade simple thresho...
9 min read →Newsletter
Attack analysis in your inbox
One email a month. Real attack postmortems, detection techniques, and engineering insights. No marketing fluff.
No spam. Unsubscribe any time.