On Monday 22 April 2024 at 06:32 UTC, a GRE flood targeted a developer platform customer in Latin America. The attack peaked at 158.3 Gbps and lasted 82 minutes. Traffic originated from 2717 autonomous systems in 95 countries, predominantly a headless-browser farm.
| Vector | GRE flood |
| Peak | 158.3 Gbps |
| Duration | 82 min |
| Time to mitigation | 0.302 s |
| Attack traffic reaching origin | 0.014% |
| Legitimate traffic challenged | 0.43% |
Timeline
The attack was preceded by a hacktivist channel announcing the target. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 36 points of presence.
What the customer saw
A brief increase in p99 latency of 27 ms during the first minute, then normal service.
Recommendations
- Review allow-listed partner ranges quarterly.
- Add a dedicated rate limit for the targeted route.
- Keep origin IPs out of public DNS history.
The billing model is what got our finance team on board, honestly.
Verified good bots and allow-listed partners bypass challenges entirely.
Carpet bombing is nasty. Good to see a clear explanation of it.
This matches what we see in iGaming around big matches.
Great to hear, thanks for sharing your experience.
Interesting that most attacks are under ten minutes. Our experience is similar.
Great to hear, thanks for sharing your experience.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.
Thanks — sharing this with our on-call team.
Solid runbook advice. The DNS-at-2am point hit home.