Threat Bulletin 0236: GRE flood against a sports betting platform in North America

On Wednesday 19 January 2022 at 11:58 UTC, a GRE flood targeted a sports betting customer in North America. The attack peaked at 384.1 Gbps and lasted 12 minutes. Traffic originated from 1812 autonomous systems in 111 countries, predominantly a headless-browser farm.

Vector GRE flood
Peak 384.1 Gbps
Duration 12 min
Time to mitigation 0.148 s
Attack traffic reaching origin 0.006%
Legitimate traffic challenged 0.58%

Timeline

The attack was preceded by a competitor’s product launch. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 18 points of presence.

What the customer saw

A brief increase in p99 latency of 55 ms during the first minute, then normal service.

Recommendations

  • Keep origin IPs out of public DNS history.
  • Enable log streaming to your SIEM for faster correlation.
  • Add a dedicated rate limit for the targeted route.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top