On Wednesday 8 October 2025 at 08:33 UTC, a SYN flood targeted a sports betting customer in Southeast Asia. The attack peaked at 190.9 Gbps and lasted 93 minutes. Traffic originated from 3507 autonomous systems in 40 countries, predominantly mobile carrier ranges.
| Vector | SYN flood |
| Peak | 190.9 Gbps |
| Duration | 93 min |
| Time to mitigation | 0.391 s |
| Attack traffic reaching origin | 0.041% |
| Legitimate traffic challenged | 0.22% |
Timeline
The attack was preceded by an extortion email received two days earlier. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 40 points of presence.
What the customer saw
Checkout conversion was unchanged compared with the same hour of the previous week.
Recommendations
- Enable authenticated origin pulls.
- Add a dedicated rate limit for the targeted route.
- Review allow-listed partner ranges quarterly.
Any plans to support per-tenant limits keyed on a JWT claim?
Solid runbook advice. The DNS-at-2am point hit home.
The point about origin IPs leaking through certificate transparency logs is underrated.
The point about origin IPs leaking through certificate transparency logs is underrated.
Machine-readable ranges are at /ips.json and via the API.
Would love a follow-up on how you handle HTTP/3 fingerprinting.
Our auditors asked for exactly this kind of incident evidence under DORA.
Nice to read a vendor blog that admits what went wrong.
Thanks! Yes — the risk score and its components are included in every log record.