On Monday 1 January 2024 at 03:20 UTC, a ACK flood targeted a developer platform customer in Southeast Asia. The attack peaked at 180.9 Gbps and lasted 71 minutes. Traffic originated from 3344 autonomous systems in 36 countries, predominantly a headless-browser farm.
| Vector | ACK flood |
| Peak | 180.9 Gbps |
| Duration | 71 min |
| Time to mitigation | 0.201 s |
| Attack traffic reaching origin | 0.068% |
| Legitimate traffic challenged | 0.08% |
Timeline
The attack was preceded by a competitor’s product launch. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 16 points of presence.
What the customer saw
The customer’s status page stayed green throughout; they learned about the attack from our notification.
Recommendations
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable authenticated origin pulls.
- Enable log streaming to your SIEM for faster correlation.