On Thursday 8 July 2021 at 10:05 UTC, a SYN flood targeted a online payments customer in the Middle East. The attack peaked at 382.8 Gbps and lasted 62 minutes. Traffic originated from 1063 autonomous systems in 36 countries, predominantly misconfigured open reflectors.
| Vector | SYN flood |
| Peak | 382.8 Gbps |
| Duration | 62 min |
| Time to mitigation | 0.643 s |
| Attack traffic reaching origin | 0.018% |
| Legitimate traffic challenged | 0.53% |
Timeline
The attack was preceded by an extortion email received two days earlier. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 24 points of presence.
What the customer saw
Checkout conversion was unchanged compared with the same hour of the previous week.
Recommendations
- Enable authenticated origin pulls.
- Enable log streaming to your SIEM for faster correlation.
- Lower challenge thresholds on authentication endpoints during high-risk events.
Great write-up. We saw almost the same pattern on our login endpoint last month.
Machine-readable ranges are at /ips.json and via the API.