The client has mitigated the attack with the normal mitigation techniques, but it’s ongoing daily and is taking some considerable focus from sysops. They wanted to know how long this attack could go on, and I said indefinitely until they chose to stop. They wanted more info, such as how much it costs the attackers to continue this DDoS rampage. I imagine they’re trying to figure out who could afford to keep this attack going for this long.

I started with any info I could find on how much it would cost to rent a botnet for attacks in 2023, and I found some numbers along the magnitude of $200 for 24 hours at 50k requests per second.

The attack, at its peak, reaches about 3 times that request rate, but only persists for an hour or so a day. Sometimes broken up into 6 10-minute sessions, 2 30-minute sessions, and sometimes an hour all at once.

Using that information, I concluded that it is costing the attacker $25 a day or less to keep this attack going and that anyone with even some disposable income could continue this for quite some time.

Consider this more a thought experiment than an actual functional need for information, I’m trying to figure out if I’m in the right ballpark. Is this math sound?