On Sunday 18 May 2025 at 09:35 UTC, a ACK flood targeted a developer platform customer in the Nordics. The attack peaked at 142.2 Gbps and lasted 22 minutes. Traffic originated from 366 autonomous systems in 106 countries, predominantly residential proxy networks.
| Vector | ACK flood |
| Peak | 142.2 Gbps |
| Duration | 22 min |
| Time to mitigation | 0.724 s |
| Attack traffic reaching origin | 0.005% |
| Legitimate traffic challenged | 0.28% |
Timeline
The attack was preceded by a publicly announced sales event. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 22 points of presence.
What the customer saw
A brief increase in p99 latency of 167 ms during the first minute, then normal service.
Recommendations
- Keep origin IPs out of public DNS history.
- Add a dedicated rate limit for the targeted route.
- Enable authenticated origin pulls.
How do you avoid challenging uptime monitors and partners?
Great write-up. We saw almost the same pattern on our login endpoint last month.
Good question. We will cover that in a follow-up post.