DDoS attack

Cloud DPS – Optimization for a Managed Security Service Customer

July 27, 2021

Today DDoS attacks are continuing to increase in frequency, volume and duration to affect a business’s continuity and reputation. DDoS mitigation capability has become the top priority for CIO/CISOs in Enterprise, Internet content providers and government, while they may have to face the challenge of finding sufficient experienced security professionals to build, maintain and operate […]

Case Study: A 400G DDoS Attack Event Captured By NSFOCUS in Hong Kong S.A.R.

July 6, 2021

Event look back A NSFOCUS Cloud DPS customer with their servers located in Hong Kong SAR has encountered a series of mass DDoS attacks lasted for four (4) days, from June 20th to 24th. The attackers managed to create serval spikes including the biggest one reaching 399.2 Gbps and followed by another at 360 Gbps. […]

Recommendations on Protection Against Random Subdomain Attacks

July 2, 2021

What is a Random Subdomain Attack? A Random subdomain attack is also known as a pseudo-random subdomain (PRSD) attack due to the use of pseudo-random algorithms. A PRSD attack is an approach of double attack against both DNS caching servers of Internet service providers (ISPs) and local authoritative servers of customers. During such an attack, […]

2020 DDoS Attack Landscape Report – 3

June 23, 2021

Key Findings – 4 DDoS Protection Techniques Need to Continue to Evolve with Emergence of New Attack Vectors NXNSAttack, a new vulnerability in DNS, can be exploited to launch massive DDoS attacks In May 2020, Israeli researchers reported a new DNS server vulnerability and dubbed it NXNSAttack. This vulnerability exists in DNS’s recursive resolution process. […]

Why only have the Gi-FW and GTP inspection isn’t enough for 5G security?

June 18, 2021

Written By: Bruno CarvalhoSystem Engineer UK & Western Europe Firstly, to become this information clearer is interesting to answer the question…What is GPRS Tunneling Protocol (GTP)? GPRS Tunneling Protocol (GTP) is a 2.5G technology that provides interconnection between various network interfaces, enabling mobile users to roam seamlessly between networks of different generations. The GTP protocol […]

NSFOCUS Protected an IDC Customer Against Volumetric Mixed DDoS Attacks

June 11, 2021

ABOUT CUSTOMER Based in APAC, company A provides comprehensive IDC services for the world’s top 500 as well as many small and medium enterprises. Other than server rental and hosting, company A also cooperates with NSFOCUS to provide server rental service with advanced protection against DDoS attacks. The investment in DDoS protection not only protects […]

A Global DTLS Amplification DDoS Attack Is Ongoing

January 1, 2021

Attackers are targeting Citrix ADC (Application Delivery Controller) and utilize it to launch amplification attacks. However, no official patch has been released yet.


Supply Chain Attack Event — Targeted Attacks on Java Projects in GitHub

November 24, 2020


Recently, GitHub’s Security Incident Response Team (SIRT) published an article saying that a set of Github code repositories were serving open-source projects that were infected with malicious code (https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain). According to the article, attackers submitted malicious code to the open-source projects, which were referenced by other open-source projects. After being used by developers, these open-source projects with malicious code will search the developers’ machines for NetBeans IDE. If the IDE is found, all Java Archive (JAR) files created by NetBeans will be infected and loaders of malware will be implanted to ensure that the projects can release a remote administration tool (RAT).


2020 Mid-Year DDoS Attack Landscape Report-4

September 1, 2020

At 17:00 of May 20, NSFOCUS SOC detected an abnormal traffic alert in the global monitoring center, the IP addresses of a customer from Hong Kong were under attack and the maximum attack peak reached 634.6 Gbps. This had been the largest of all attacks targeting NSFOCUS’s customers by the
time this report was written. According to IP gang intelligence from the NSFOCUS Threat Intelligence (“NTI”), large quantities of source IP addresses involved in the attack were controlled by the IP gang IPGang01 we have continuously monitored. We will elaborate on it in the following “attack gangs” chapter.


2020 Mid-Year DDoS Attack Landscape Report-3

August 29, 2020

From January to May 2020, except in April when the number of DDoS attacks was on a par with that a year earlier, the other months experienced a year-on-year decrease in the number. However, attack traffic in each month in the first half of 2020 increased year on year.