> series: anatomy_of_a_breach —— part: 051 —— target: spamhaus —— peak_traffic: 300_gbps —— method: dns_amplification<span class="cursor-blink">_</span>_
In March 2013, Spamhaus — the London and Geneva-headquartered organisation that maintains DNS-based blocklists used by email providers worldwide to filter spam — was targeted by a DDoS attack that peaked at approximately 300 Gbps. The attack was so large that CloudFlare, which was providing DDoS mitigation for Spamhaus, reported that the traffic volume caused measurable congestion at internet exchange points across Europe, affecting internet performance for users who had no connection to either Spamhaus or the attackers.
The attack used DNS amplification — a technique that exploits open DNS resolvers to multiply the volume of attack traffic. The attacker sends small DNS queries to open resolvers with the source IP address spoofed to appear as the victim's address. The resolvers respond with much larger DNS replies directed at the victim, amplifying the traffic by a factor of 50x or more. The Spamhaus attack demonstrated that DNS amplification could generate traffic volumes sufficient to overwhelm not just a single target but the internet infrastructure that connects it.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallSpamhaus, founded by Steve Linford in 1998, is headquartered in London with operations in Geneva. Its blocklists are used by email providers, corporations, and governments worldwide to filter spam and malware distribution. An attack on Spamhaus is effectively an attack on global email infrastructure — and the UK's role as host to this critical internet organisation made the attack a matter of national concern.
The Spamhaus attack established that DDoS traffic volumes can reach hundreds of gigabits per second — far beyond the capacity of any single organisation to absorb on its own. Defence requires upstream mitigation (CDN-based or ISP-based traffic scrubbing), architectural resilience (Anycast distribution, geographic redundancy), and incident response planning that includes communication with upstream providers, customers, and stakeholders during an attack.
Our infrastructure penetration testing assesses DDoS preparedness — including your organisation's ability to survive volumetric, protocol, and application-layer attacks. Cyber Essentials establishes baseline infrastructure security. SOC in a Box monitors for the reconnaissance and early-stage traffic patterns that precede DDoS attacks. And UK Cyber Defence provides incident response during active DDoS events.
Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses your DDoS resilience. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for attack precursors. Because when the traffic reaches hundreds of gigabits, only prepared organisations survive.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call