Cyber Incident Victim: Point DNS
Date:
May 2014
Location:
China
Summary
A distributed denial-of-service attack targeted Point DNS, disrupting domain resolution and email delivery for over 220,000 domains, with significant impact in Asia and Europe. The attack, originating from China and peaking at 25 million packets per second, was mitigated through additional nameservers, network provider collaboration, and a secondary network, restoring services after approximately four hours of downtime.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 9, 2014, Point DNS experienced a widespread distributed denial-of-service (DDoS) attack targeting all its DNS servers, severely disrupting services for its client base of over 220,000 domains. The attack began in the early morning hours US West Coast time, according to Ed Byrne of copper.io, a provider offering PointDNS among its security tools. Point DNS acknowledged the incident via Twitter, stating it was actively working to mitigate the assault while adding more nameservers and coordinating with network providers to contain the damage. The attack rendered domain name resolution via browsers nonfunctional for affected clients and disrupted email delivery for associated domains, with initial reports indicating users in Asia and Europe faced the most severe accessibility issues. Customer queries were disabled for approximately four hours during the peak of the incident, significantly impairing online operations for dependent businesses and services.
Security firm Incapsula observed a comparable DNS flood attack during the same timeframe, noting traffic volumes peaking at 25 million packets per second. Incapsula’s Igal Zeifman highlighted the unique challenge of DNS flood attacks, explaining that unlike amplification-based DDoS attacks—which can be identified and blocked at network edges—DNS floods require servers to process each query before determining legitimacy, complicating mitigation efforts. Byrne confirmed the attack’s origin in China and described it as ongoing but subsiding, with copper.io implementing countermeasures through a secondary network to reduce the operational impact. Point DNS maintained public updates throughout the incident but did not disclose specific technical details about the attack vectors or the full scope of infrastructure adjustments deployed during the response. The company’s mitigation efforts restored service functionality after several hours, though the precise timeline for full operational recovery remains unspecified in available reports.