By 
A European DDoS protection provider recently faced a massive distributed denial-of-service (DDoS) assault that peaked at 1.5 billion packets per second (Bpps)—making it one of the largest packet-rate floods publicly disclosed.
According to security firm FastNetMon, which helped mitigate the incident, the attack originated from compromised IoT devices and MikroTik routers spread across more than 11,000 networks worldwide. The malicious traffic primarily consisted of UDP floods launched from hijacked customer-premises equipment (CPE).
While the affected customer was not named, FastNetMon described them as a DDoS scrubbing provider—a service that filters malicious traffic through methods such as packet inspection, anomaly detection, CAPTCHA challenges, and rate limiting.
The attack was detected in real time, with mitigation measures deployed through the customer’s scrubbing facility. Defensive steps included applying access control lists (ACLs) on edge routers commonly abused for amplification attacks.
This attack comesclosely after Cloudflare announced blocking the largest volumetric DDoS attack to date, which peaked at 11.5 Tbps and 5.1 Bpps. Both incidents had the same goal: overwhelming processing systems to cause service outages.
FastNetMon founder Pavel Odintsov warned that such massive attacks highlight a growing threat, stressing the need for intervention at the ISP level. He added that, what makes this case remarkable is the sheer number of distributed sources and the abuse of everyday networking devices. Without proactive ISP-level filtering, compromised consumer hardware can be weaponized at scale.
He further urged the industry to adopt ISP-level detection and filtering to prevent outgoing attacks before they escalate.
