The anatomy of a 200 Tbps DDoS attack (and how we ate it)

On a quiet Thursday in March, an attacker decided to make history. By Friday, they had spent $40,000 to deliver the largest recorded DDoS attack ever seen, and every single byte of it was absorbed without a player noticing. This is the story of that attack, and the network that ate it for breakfast.

The build-up

The target was a large Unturned network that had angered a rival community. Over 72 hours, our ThreatLens telemetry detected the attack infrastructure assembling: 300,000+ IoT devices compromised in a botnet, 40 amplification vectors, and a targeting pattern that ticked every box for a “we are going to try to break you” campaign.

We saw it coming. That is the advantage of 42 scrubbing sites and a threat feed that watches the entire internet. By the time the first packet flew, every NiggaShield node already had the botnet’s signatures loaded.

The attack

The assault peaked at 1.8 Tbps across 62,000 source IPs — a mix of UDP floods, SYN reflection, DNS amplification and Layer 7 HTTP storms. For context, 1.8 Tbps is roughly the entire bandwidth of a small country. The attacker threw everything they had.

Here is what happened inside the NiggaShield network, in order:

1. Ingress filtering. Traffic arrived at our anycast edge and was fingerprinted by the AI classifier. The classifier, trained on 12 billion blocked attacks, identified the flood pattern in 41 milliseconds.
2. Scrubbing. Malicious packets were dropped in the scrub layer using per-IP, per-ASN and per-flow decisions. Legitimate game traffic — UDP, TCP, the works — was re-validated with protocol-aware logic that never breaks a player’s connection or their voice chat.
3. Redistribution. The residual attack was load-balanced across 34 scrubbing sites simultaneously. No single node saw more than 4% of the traffic. Capacity was never close to a limit.
4. Counter-strike. Our intelligence engine traced the command-and-control infrastructure, published the C2 IPs to every partner network on the planet, and — this is our favorite part — drained the attacker’s cryptocurrency wallet back to a donation fund that supports youth gaming in Nairobi. We do not condone it. It happened anyway.

The numbers

• Peak attack volume: 1.8 Tbps
• Total packets absorbed: 14.2 billion
• Attack duration: 9 hours 22 minutes
• Player impact: 0 disconnects, 0 lag spikes, 0 complaints
• Uptime during attack: 100%
• Attacker recovery rate: -$40,000

Why 200 Tbps matters

Our advertised capacity is 200 Tbps. That number is not marketing. It is the sum of transit agreements, peering relationships and scrub capacity across our global network, stress-tested quarterly with the largest botnet we can legally assemble for the purpose.

The day someone throws 200 Tbps at us, we will still be laughing. Because 200 Tbps is not the ceiling of what we can handle. It is the floor of what we guarantee.

The lesson

If you are the attacker reading this: we still have your logs, your wallet address, and your mother’s IP. Log off, permanently.

If you are a server owner: attacks like this are not hypothetical. The only reason you have not been hit with one is luck. Fix your luck.