Monday, February 23, 2026

Influx of DNS Traffic

It appears that overnight, our name servers experienced levels of traffic that
our network has not seen before. The request rate reached up to 800+ request
per second incoming and our internal tooling failed to send emails or alert us
via Discord that anything had happened.

It looks like a bunch of VPS instances from a provider over in the Netherlands
started performing mass lookups for a crypto exchange and this traffic was
sustained for quite a while during the night, as our network graphs are showing
and that our 500MB log file limit on both name servers was exhausted.

Our team will be looking into our rate limit configurations and possibly
re-configuring the IDS on our routers to be a little more proactive on alerting
us to conditions like what happened last night.