On Thursday 6 February 2025 at 05:25 UTC, a SYN flood targeted a municipal services customer in Latin America. The attack peaked at 230.1 Gbps and lasted 78 minutes. Traffic originated from 508 autonomous systems in 84 countries, predominantly hijacked home routers.
| Vector | SYN flood |
| Peak | 230.1 Gbps |
| Duration | 78 min |
| Time to mitigation | 0.581 s |
| Attack traffic reaching origin | 0.022% |
| Legitimate traffic challenged | 0.60% |
Timeline
The attack was preceded by an extortion email received two days earlier. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 27 points of presence.
What the customer saw
A brief increase in p99 latency of 95 ms during the first minute, then normal service.
Recommendations
- Review allow-listed partner ranges quarterly.
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable authenticated origin pulls.
Is the risk score exposed in the logs so we can build our own dashboards on it?
Any plans to support per-tenant limits keyed on a JWT claim?
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.