On Wednesday 28 December 2022 at 19:13 UTC, a ACK flood targeted a online casino customer in Western Europe. The attack peaked at 88.0 Gbps and lasted 52 minutes. Traffic originated from 4187 autonomous systems in 17 countries, predominantly mobile carrier ranges.
| Vector | ACK flood |
| Peak | 88.0 Gbps |
| Duration | 52 min |
| Time to mitigation | 0.918 s |
| Attack traffic reaching origin | 0.058% |
| Legitimate traffic challenged | 0.66% |
Timeline
The attack was preceded by no stated motive. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 15 points of presence.
What the customer saw
The customer’s status page stayed green throughout; they learned about the attack from our notification.
Recommendations
- Enable log streaming to your SIEM for faster correlation.
- Add a dedicated rate limit for the targeted route.
- Review allow-listed partner ranges quarterly.