DDoS Attack Vectors
Interactive Periodic Table of Vectors
ATTACK COUNT
500,001+
50,001 - 500,000
0 - 50,000
- 3.8:1 Bt ○○○●● Bittorrent Amplification 2
- 56.89:1 Cd ○○○○● CLDAP Amplification 3
- Ds DNS 4
- 160:1 Dn ●●●●● DNS Amplification 5
- Im ICMP 6
- 10:1 Ik ○○○○● ISAKMP 7
- 13.5:1 Lt ●●●●● L2TP Amplification 9
- 4.35:1 Md ○○○●● mDNS Amplification 10
- 51,200:1 Mc ○○○○● memcached Amplification 11
- 25:1 Mq ○○○●● MS SQL RS Amplification 12
- 556.9:1 Np ○○○○● NTP Amplification 13
- 6.3:1 Sn ●●●●● SNMP Amplification 15
- 30.8:1 Ss ●●●●● SSDP Amplification 16
- 3.32:1 St ○○○●● STUN Amplification 17
- Ta TCP ACK 18
- Tn TCP null 19
- Tr TCP RST 21
- Ts TCP SYN 22
- 3:1 Tk TCP SYN/ACK Amplification 23
- 2,464:1 Un ○○○○● Unreal-tournament Amplification 24
- 14:1 Ve ○○○○● VSE Amplification 25
- 500:1 Wd ○○○○● WS-DD Amplification 27
- 35.5:1 Ar ○○○○● ARMS Amplification 28
- 1,000:1 Ch ○○○○● chargen Amplification 29
- 34:1 Cp ○○●●● COAP Amplification 30
- 34:1 Cp ○○●●● COAP Amplification 31
- In IP null 34
- Iv IPv4 Protocol 0 35
- 3:1 Nb ○●●●● NetBIOS Amplification 36
- 33.9:1 Ov ●●●●● OpenVPN Amplification 37
- 85.9:1 Rd ○○○○● RDP Amplification 39
- 134.24:1 Ri ○○●●● RIPv1 Amplification 40
- 29:1 Rc ●●●●● rpcbind Amplification 41
- 10:1 Sp ●●●●● SIP Amplification 42
- 2,200:1 Sl ○○○○● SLP Amplification 43
- 46.5:1 Tf ●●●●● TFTP Amplification 45
- 4:1 Ub ○○○○● Ubiquiti Amplification 46
- 120:1 Bc ○○○○● BACnet Amplification 47
- 5.7:1 Ci ○○○○● Citrix-ICA Amplification 48
- 37.34:1 Dt D/TLS Amplification 49
- 25.68:1 Di ○○○●● DHCP Discovery Amplification 51
- Ht HTML5 52
- 1.1:1 Ip ○○○●● IPMI Amplification 53
- 5.6:1 Jk ○○○○● Jenkins Amplification 54
- 700,000:1 Mh ●●●●● MBHTTP Amplification 55
- 4.68:1 Pm ○○○●● PMSSDP Amplification 56
- 140.3:1 Qd ○○○○● QOTD Amplification 57
- 63.9:1 Qk ○○○○● Quake Amplification 58
- Variable Qc ○●●●● QUIC 59
- 30.7:1 Se ○○○○● Sentinel Amplification 60
- 4,294,967,296:1 Tp ○○○○● TP240 Amplification 61
Attack Count
500,001+
50,001 - 500,000
0 - 50,000
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Bittorrent Amplification
Nodes running older versions of BitTorrent P2P file-sharing applications can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
3.8:1
Number of Attacks
745,340
Reflectors/Amplifiers
785,630
Port Number
6881
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
CLDAP Amplification
Unsecured Connectionless Lightweight Directory Access Protocol (CLDAP) services can be leveraged to launch refleection/amplification DDoS attacks. Most abusable CLDAP reflectors/ampliifers are Microsoft Windows servers which have been unwisely exposed to the public Internet.
Amplification Number
56.89:1
Number of Attacks
542,210
Reflectors/Amplifiers
136,790
Port Number
389
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
DNS
Programmatically-generated DNS queries mainly intended to overwhelm authoritative DNS servers; recursive DNS servers can also be targeted, and can be negatively impacted if used to reflect DNS query-floods towards targeted authoritative DNS servers. Queried Resource Records (RRs) can be pseudorandomly-generated ('DNS Water Torture'), or chosen from a dictionary of tens of thousands of plaubile-sounding labels (i.e, the 'Dyn attack').
Number of Attacks
7,501,450
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
DNS Amplification
A DNS reflection/amplification DDoS attack is a common two-step DDoS attack in which the attacker manipulates open DNS servers.
Amplification Number
160:1
Number of Attacks
21,360,720
Reflectors/Amplifiers
11,106,600
Port Number
53
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
ICMP
Programmatically-generated ICMP packets intended to consume link bandwidth (bps)/throughput (pps), as well as the capacity of targeted nodes to generate ICMP responses in the case of ICMP Echo Request (i.e., ping) floods. ICMP floods are measured in both bits-per-second (bps) and packets-per-second (pps), and are a form of volumetric DDoS attack.
Number of Attacks
15,077,240
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
ISAKMP
Misconfigured VPN servers and concentrators supporting the ISAKMP/IKE key-exchange methodology can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
10:1
Number of Attacks
981,480
Reflectors/Amplifiers
160,080
Port Number
500
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
L2TP Amplification
Misconfigured VPN servers and concentrators supporting the L2TP protocol can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
13.5:1
Number of Attacks
1,995,600
Reflectors/Amplifiers
20,684,210
Port Number
1701
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
mDNS Amplification
Internet-exposed nodes running misconfigured, abusable mDNS services can be leveraged to launch reflection/amplication DDoS attacks.
Amplification Number
4.35:1
Number of Attacks
1,073,000
Reflectors/Amplifiers
1,792,890
Port Number
5353
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
memcached Amplification
Misconfigured, internet-exposed memcached database-caching servers can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
51,200:1
Number of Attacks
1,038,400
Reflectors/Amplifiers
3,880
Port Number
11211
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
MS SQL RS Amplification
Abusable, internet-exposed Microsoft SQL Server nodes running the SQL Server Reporting Service can be leveraged to launch reflection/amplification attacks.
Amplification Number
25:1
Number of Attacks
1,112,440
Reflectors/Amplifiers
701,730
Port Number
1434
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
NTP Amplification
Misconfigured Network Time Protocol (NTP) servers that expose abusable administrative functions to the internet can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
556.9:1
Number of Attacks
5,149,830
Reflectors/Amplifiers
53,090
Port Number
123
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
SNMP Amplification
Routers, layer-3 switches, Wi-Fi access points, servers, and other internet-connected devices running the SNMPv2 management protocol, and which have been misconfigured to expose it to the internet with default credentials, can be leveraged to launch reflection/amplification attacks.
Amplification Number
6.3:1
Number of Attacks
908,780
Reflectors/Amplifiers
10,205,140
Port Number
161
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
SSDP Amplification
Consumer-grade broadband access routers that expose Simple Service Discovery Protocol (SSDP) to the internet can be leveraged to launch SSDP reflection/amplification attacks.
Amplification Number
30.8:1
Number of Attacks
1,485,480
Reflectors/Amplifiers
6,987,320
Port Number
1900
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
STUN Amplification
Nodes running the STUN protocol used to provide dynamic mapping of NATted private IP addresses to publicly routable IP addresses can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
3.32:1
Number of Attacks
4,543,630
Reflectors/Amplifiers
1,678,630
Port Number
3478,
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP ACK
Programmatically-generated TCP ACK packets primarily intended to overwhelm the state-tables of stateful firewalls, load-balancers, ‘IPS’ devices, etc. by forcing them to perform multiple simultaneous lookups for non-existent connections. Most ACK-floods are spoofed. ACK-floods are primarily measured in packets-per-second (pps), and are a volumetric form of DDoS attack.
Number of Attacks
26,910,990
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP null
Programmatically-generated TCP packets with no flags and no actual payload; they are typically padded with either zeroes or pseudo-random characters. TCP Null Floods are primarily intended to overwhelm the TCP/IP stacks of targeted nodes with payloadless packets, as well as consume link capacity.
Number of Attacks
549,040
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP RST
Programmatically-generated TCP RST packets primarily intended to overwhelm the state-tables of stateful firewalls, load-balancers, ‘IPS’ devices, etc. by forcing them to perform multiple simultaneous lookups for non-existent connections. Most RST-floods are spoofed. RST-floods are primarily measured in packets-per-second (pps), and are a volumetric form of DDoS attack.
Number of Attacks
12,295,920
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP SYN
Programmatically-generated TCP SYN packets intended to overwhelm the TCP stacks of targeted hosts, consuming their capacity to instantiate new TCP connections for legitimate clients. SYN-Floods can also exhaust the state-tables of stateful firewalls, load-balancers, ‘IPS’ devices, et. al. Most SYN-Floods are spoofed. SYN-floods are primarily measured in packets-per-second (pps), and are both a volumetric and a connection-oriented form of DDoS attacks.
Number of Attacks
17,061,350
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP SYN/ACK Amplification
Any node which runs a TCP-based service such as Web servers, SMTP mail relays, etc. can potentially be leveraged to launch TCP reflection/amplification DDoS attacks.
Amplification Number
3:1
Number of Attacks
12,510,570
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Unreal-tournament Amplification
Multiplayer game servers running deprecated versions of the Unreal Tournament online gaming protocol can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
2,464:1
Number of Attacks
594,760
Reflectors/Amplifiers
16,130
Port Number
7777-7788
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
VSE Amplification
Multiplayer game servers running deprecated versions of the Valve Steam Engine (VSE) online gaming protocol can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
14:1
Number of Attacks
597,410
Reflectors/Amplifiers
164,590
Port Number
27015-27021,
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
WS-DD Amplification
Misconfigured, internet-exposed nodes running the Web Services Dynamic Discovery (WS-DD) protocol can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
500:1
Number of Attacks
524,030
Reflectors/Amplifiers
184,700
Port Number
3702
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
ARMS Amplification
Internet-exposed Apple computers running older versions of the Apple Remote Management System (ARMS) protocol can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
35.5:1
Number of Attacks
107,010
Reflectors/Amplifiers
47,030
Port Number
3283
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
chargen Amplification
Systems running the legacy character-generator (chargen) network test facility can be abused to launch reflection/amplification DDoS attacks. Most chargen reflectors/amplifiers are IoT devices, which often have such abusable legacy services running by default.
Amplification Number
1,000:1
Number of Attacks
403,220
Reflectors/Amplifiers
114,190
Port Number
19
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
COAP Amplification
Misconfigured Constrained Application Protocol (CoAP) M2M speakers can be leveraged to launch reflection/amplification DDoS attacks. Most abusable CoAP reflectors/amplifiers are embedded IoT devices connected to the internet over wireless broadband carriers. Like other UDP-based protocols, CoAP can be exploited to perform UDP reflection/amplification DDoS attacks.
Amplification Number
34:1
Number of Attacks
147,010
Reflectors/Amplifiers
2,416,250
Port Number
5683
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
COAP Amplification
Misconfigured Constrained Application Protocol (CoAP) M2M speakers can be leveraged to launch reflection/amplification DDoS attacks. Most abusable CoAP reflectors/amplifiers are embedded IoT devices connected to the internet over wireless broadband carriers. Like other UDP-based protocols, CoAP can be exploited to perform UDP reflection/amplification DDoS attacks.
Amplification Number
34:1
Number of Attacks
147,010
Reflectors/Amplifiers
2,239,550
Port Number
5683
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
IP null
Programmatically-generated IP packets with no actual payload; they are typically padded with either zeroes or pseudo-random characters. IP Null Floods are primarily intended to overwhelm the TCP/IP stacks of targeted nodes with payloadless packets, as well as to consume link bandwidth (bps)/throughput (pps). IP Null floods are measured in both bits-per-second (bps) and packets-per-second (pps), and are a volumetric form of DDoS attack.
Number of Attacks
390,000
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
IPv4 Protocol 0
Programmatically-generated IPv4 Protocol 0 packets intended to consume link bandwidth/throughput, as well as the capacity of targeted nodes to process incoming packets. IPv4 Protocol 0 is an invalid protocol number, but is forwarded by most routers and layer-3 switches. IPv4 Protocol 0 floods are measured in both bits-per-second (bps) and packets-per-second (pps), and are a form of volumetric DDoS attack.
Number of Attacks
358,520
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
NetBIOS Amplification
Network Basic Input/Output System (NetBIOS) provides services related to the session layer of the OSI model that allow applications on separate computers to communicate over a local area network. An attacker can cause a victim's machine to refuse all NetBIOS network traffic, resulting in a denial of service.
Amplification Number
3:1
Number of Attacks
446,640
Reflectors/Amplifiers
4,004,090
Port Number
137
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
OpenVPN Amplification
OpenVPN servers and concentrators running outdated software can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
33.9:1
Number of Attacks
476,800
Reflectors/Amplifiers
9,754,470
Port Number
1194
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
RDP Amplification
Misconfigured, abusable Microsoft Windows Remote Desktop Protocol (RDP) servers that are exposed to the internet can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
85.9:1
Number of Attacks
144,110
Reflectors/Amplifiers
28,210
Port Number
3389
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
RIPv1 Amplification
Nodes that expose the deprecated RIPv1 routing protocol to the internet can be abused to launch reflection/amplification attacks.
Amplification Number
134.24:1
Number of Attacks
251,510
Reflectors/Amplifiers
2,496,790
Port Number
520
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
rpcbind Amplification
Misconfigured servers that expose the rpcbind/portmapper service to the internet can be leveraged to launch reflection/amplification attacks.
Amplification Number
29:1
Number of Attacks
282,670
Reflectors/Amplifiers
14,412,810
Port Number
111
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
SIP Amplification
Misconfigured, internet-exposed Session Border Controllers (SBCs) and voice-over-IP (VoIP) PBXes can be abused to launch Session Initiation Protocol (SIP) reflection/amplification DDoS attacks.
Amplification Number
10:1
Number of Attacks
314,210
Reflectors/Amplifiers
28,410,840
Port Number
5060
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
SLP Amplification
Misconfigured, publicly-exposed Session Location Protocol (SLP) responders can be leveraged to launch reflection/amplification attacks. Many abusable SLP responders are actually Internet-exposed print servers.
Amplification Number
2,200:1
Number of Attacks
182,920
Reflectors/Amplifiers
223,550
Port Number
427
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TFTP Amplification
Misconfigured, publicly exposed Trivial File Transfer Protocol (TFTP) servers can be leveraged to launch reflection/amplification attacks. Many abusable TFTP servers are actually routers or other network infrastructure devices.
Amplification Number
46.5:1
Number of Attacks
115,120
Reflectors/Amplifiers
9,223,660
Port Number
69
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Ubiquiti Amplification
Some Ubiquiti wireless access devices running outdated software and that expose their managagment protocol to the public internet can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
4:1
Number of Attacks
266,650
Reflectors/Amplifiers
200,520
Port Number
10001
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
BACnet Amplification
Internet-exposed servers and IoT devices running the BACNet HVAC management system protocol can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
120:1
Number of Attacks
24,150
Reflectors/Amplifiers
150,340
Port Number
47808
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Citrix-ICA Amplification
Citrix Independent Computing Architecture (Citrix ICA) is a proprietary protocol for an application server system. Designed by Citrix Systems, it is not bound to any single platform and lays down specification for passing data between server and clients. Citrix ICA includes a server software component, a network protocol component, and a client software component. The Citrix ICA protocol has been used as an attack vector for DDoS attacks.
Amplification Number
5.7:1
Number of Attacks
29,040
Reflectors/Amplifiers
37,330
Port Number
1604
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
D/TLS Amplification
Improperly implemented D/TLS servers and load-balancers can be leveraged to launch reflection/amplification DDoS attacks. Most D/TLS reflectors/amplifiers are hardware load balancers running outdated software.
Amplification Number
37.34:1
Number of Attacks
N/A
Reflectors/Amplifiers
N/A
Port Number
4443
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
DHCP Discovery Amplification
Internet-exposed DVRs and other types of IoT devices running the DHCPDiscover management protocol can be leveraged to launch reflection/amplification DDoS attacks (note that despite its name, DHCPDiscover is unrelated to the DHCP IP address-management protocol).
Amplification Number
25.68:1
Number of Attacks
41,890
Reflectors/Amplifiers
537,890
Port Number
37810
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
HTML5
HTML5 (Hypertext Markup Language) is used for structuring and presenting content on the World Wide Web. The HTML5 language's ping attribute is used by websites as a mechanism to notify a website if a user follows a given link on a page. It has also been utilized as a DDoS attack vector to overwhelm targeted victims.
Number of Attacks
N/A
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
IPMI Amplification
Internet-exposed Baseband Management Controller (BMC) server management subsystems running the RMCP protocol can be leveraged to launch reflection/amplification attacks. These combined suites of hardware and software are collectively referred to as Intelligent Platform Management Interface (IPMI) systems.
Amplification Number
1.1:1
Number of Attacks
6,850
Reflectors/Amplifiers
502,950
Port Number
623
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Jenkins Amplification
Servers running obsolete versions of the popular Jenkins automation suite can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
5.6:1
Number of Attacks
24,100
Reflectors/Amplifiers
302,920
Port Number
33848
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
MBHTTP Amplification
Large-scale state-sponsored, ISP-operated, and enterprise-run Web censorship systems which do not properly establish a TCP 3-way handshake prior to transmitting policy-violation responses to offending clients can be leveraged to launch reflection/ampification DDoS attacks.
Amplification Number
700,000:1
Number of Attacks
N/A
Reflectors/Amplifiers
36,435,320
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
PMSSDP Amplification
Plex Media Server nodes running outdated software and exposed to the public internet can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
4.68:1
Number of Attacks
N/A
Reflectors/Amplifiers
594,930
Port Number
32410,
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
QOTD Amplification
The legacy Quote-of-the-Day (QotD) network entertainment service can be leveraged to launch reflection/amplification DDoS attacks. It is mainly found today on IoT devices running insecure default configurations that expose abusable, outdated services to the internet at large.
Amplification Number
140.3:1
Number of Attacks
26,620
Reflectors/Amplifiers
114,980
Port Number
17
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Quake Amplification
Quake game servers running legacy, outdated multiplayer software can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
63.9:1
Number of Attacks
48,090
Reflectors/Amplifiers
11,810
Port Number
27960,
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
QUIC
A limited population of misconfigured QUIC servers can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
Variable
Number of Attacks
N/A
Reflectors/Amplifiers
5,099,520
Port Number
443
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Sentinel Amplification
SPSS statistical software-licensing servers running outdated software can be abused to launch Sentinel reflection/amplification DDoS attacks.
Amplification Number
30.7:1
Number of Attacks
23,700
Reflectors/Amplifiers
10,320
Port Number
5093
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TP240 Amplification
A test facility present in unpatched Mitel VoIP gateways running deprecated software versions can be abused to launch reflection/amplification DDoS attacks with a record-breaking amplification factor of 4,294,967,296:1.
Amplification Number
4,294,967,296:1
Number of Attacks
22,740
Reflectors/Amplifiers
39,860
Port Number
10074
