On Friday 6 September 2024 at 12:07 UTC, a ACK flood targeted a crypto exchange customer in the UK. The attack peaked at 181.1 Gbps and lasted 131 minutes. Traffic originated from 632 autonomous systems in 70 countries, predominantly misconfigured open reflectors.
| Vector | ACK flood |
| Peak | 181.1 Gbps |
| Duration | 131 min |
| Time to mitigation | 0.224 s |
| Attack traffic reaching origin | 0.089% |
| Legitimate traffic challenged | 0.53% |
Timeline
The attack was preceded by a hacktivist channel announcing the target. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 14 points of presence.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Enable log streaming to your SIEM for faster correlation.
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable authenticated origin pulls.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.
Clear and practical, thanks.
Solid runbook advice. The DNS-at-2am point hit home.
Do you publish the edge IP ranges in a machine-readable format?
Any plans to support per-tenant limits keyed on a JWT claim?
Great write-up. We saw almost the same pattern on our login endpoint last month.
Machine-readable ranges are at /ips.json and via the API.
Clear and practical, thanks.
Thanks! Yes — the risk score and its components are included in every log record.
Solid runbook advice. The DNS-at-2am point hit home.