Amplification attacks are an old technique that keeps working because the internet keeps having open services that reflect.
The shape from inside scrubbing looks like this:
Minute 0
A small probe hits the target — a few hundred packets, nothing alarming. The attacker is checking whether their reflectors can reach the destination.
Minute 1–2
Volume climbs fast. Source ports cluster around 53 (DNS) or 123 (NTP) — the reflector services being abused. Source IPs are scattered across thousands of distinct addresses.
Minute 3 onward
If the filter is doing its job, attack traffic is already being dropped at the edge. Mitigation profile shifts toward strict source-port matching on the abused service. Legitimate traffic — outbound DNS responses to actual queries — keeps flowing.
The customer experience: they don't notice.