On Tuesday 10 August 2021 at 05:03 UTC, a ACK flood targeted a developer platform customer in Iberia. The attack peaked at 271.4 Gbps and lasted 69 minutes. Traffic originated from 1864 autonomous systems in 44 countries, predominantly mobile carrier ranges.
| Vector | ACK flood |
| Peak | 271.4 Gbps |
| Duration | 69 min |
| Time to mitigation | 0.504 s |
| Attack traffic reaching origin | 0.088% |
| Legitimate traffic challenged | 0.14% |
Timeline
The attack was preceded by a ransom note demanding payment in Monero. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 35 points of presence.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Enable log streaming to your SIEM for faster correlation.
- Review allow-listed partner ranges quarterly.
- Keep origin IPs out of public DNS history.
Would love a follow-up on how you handle HTTP/3 fingerprinting.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Do you publish the edge IP ranges in a machine-readable format?
The billing model is what got our finance team on board, honestly.
Do you publish the edge IP ranges in a machine-readable format?
Verified good bots and allow-listed partners bypass challenges entirely.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.