01 — STATUS
All systems.
90 days of history, uncut.
Not a nice-to-have. We dissect every incident in public — what happened, how we caught it, how long we held, and what we fixed for good.
FRA-04
99.999%
AMS-01
99.998%
WAW-02
99.997%
MSK-03
99.996%
SIN-01
99.999%
ASH-02
99.998%
90 days ago● operationaltoday
02 — POSTMORTEMS
Real attacks.
How we fought them off.
2026 · 04 · 18
INC-2026-0418
UDP + SYN mix 10.4 Tbps · 47 min RECORD
A coordinated attack on our AS — UDP amplification from a Mirai-fork botnet plus a SYN flood from 280k unique IPs. Mitigation triggered in 1.8 s, downtime: zero. Of the 184 protected servers, not one went down.
PEAK10.4 Tbps
PPS1.84 Gpps
DURATION47 min
DOWNTIME0 s
2026 · 03 · 02
INC-2026-0302
L7 join-flood from 14k IPs · 2 h 18 min L7
A distributed /join flood on the 1.8.9 client spec with forged handshakes. The web captcha was shown to just 2.1% of real players — the rest were stopped by the bot gate.
PEAK CPS14 200 / s
BLOCKED91.4 M
DURATION2 h 18 min
DOWNTIME0 s
2026 · 02 · 11
INC-2026-0211
Killaura wave across 9 servers ANTICHEAT
A script kiddie handed out a reverse-engineered client that bypassed one of the anticheats. The Tier-2 ML model caught it by rotation pattern within 14 minutes of the first spawn. 612 bans in a single rolling deploy.
DETECTED612 players
FALSE POSITIVE0.07%
TIME-TO-MITIGATE14 min
MODEL VERSIONtier2-v4.7
2026 · 01 · 26
INC-2026-0126
DNS amplification 3.2 Tbps · 22 min L3
A classic DNS amp against our anycast prefix. Absorbed at ingress with no traffic shift and no last-mile drops.
PEAK3.2 Tbps
PPS0.41 Gpps
DURATION22 min
DOWNTIME0 s
2025 · 12 · 09
INC-2025-1209
Status-spoof campaign · 240k botnet CACHE
A mass /status flood with spoofed server-list records. The status cache absorbed 99.4% of requests before they hit origin. Servers affected: zero.
UNIQUE IP240 800
CACHE HIT99.4%
ORIGIN HITS184 / s
DOWNTIME0 s
Click an entry for the full timeline. Raw pcap samples are available to BLACKLINE customers.