On Saturday 5 August 2023 at 00:43 UTC, a SYN flood targeted a fashion retail customer in Southeast Asia. The attack peaked at 358.6 Gbps and lasted 180 minutes. Traffic originated from 783 autonomous systems in 27 countries, predominantly residential proxy networks.
| Vector | SYN flood |
| Peak | 358.6 Gbps |
| Duration | 180 min |
| Time to mitigation | 0.522 s |
| Attack traffic reaching origin | 0.007% |
| Legitimate traffic challenged | 0.57% |
Timeline
The attack was preceded by a ransom note demanding payment in Monero. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 35 points of presence.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Enable log streaming to your SIEM for faster correlation.
- Review allow-listed partner ranges quarterly.
- Add a dedicated rate limit for the targeted route.
Could you share the dataset behind the percentages?
Clear and practical, thanks.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Clear and practical, thanks.
The point about origin IPs leaking through certificate transparency logs is underrated.