On Tuesday 2 June 2026 at 16:04 UTC, a GRE flood targeted a fashion retail customer in North America. The attack peaked at 99.7 Gbps and lasted 104 minutes. Traffic originated from 1213 autonomous systems in 81 countries, predominantly a Mirai-derived IoT botnet.
| Vector | GRE flood |
| Peak | 99.7 Gbps |
| Duration | 104 min |
| Time to mitigation | 0.023 s |
| Attack traffic reaching origin | 0.049% |
| Legitimate traffic challenged | 0.68% |
Timeline
The attack was preceded by no stated motive. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 37 points of presence.
What the customer saw
A brief increase in p99 latency of 155 ms during the first minute, then normal service.
Recommendations
- Add a dedicated rate limit for the targeted route.
- Keep origin IPs out of public DNS history.
- Enable authenticated origin pulls.
Thanks — sharing this with our on-call team.
Good question. We will cover that in a follow-up post.
Nice to read a vendor blog that admits what went wrong.
The point about origin IPs leaking through certificate transparency logs is underrated.
This matches what we see in iGaming around big matches.
Could you share the dataset behind the percentages?
Thanks! Yes — the risk score and its components are included in every log record.
Our auditors asked for exactly this kind of incident evidence under DORA.
Great to hear, thanks for sharing your experience.
Could you share the dataset behind the percentages?