How to Identify a DDoS Attack

A distributed denial-of-service (DDoS) cyberattack is a cybercriminal’s attempt to interrupt an online service by flooding it with fake traffic. This can be achieved by overwhelming various aspects of an organization’s system, such as servers, devices, networks and applications. During a DDoS attack, cybercriminals send a deluge of requests to a victim’s server, intending to exceed the capacity limits of their websites, servers and networks and halt services. The impact of these attacks can be broad; some result in minor annoyances, while others may cause entire websites, networks or businesses to be taken offline.

DDoS attacks are designed to mimic legitimate traffic from real users, which can make them difficult to identify. Often, DDoS attacks can be mistaken for commonplace technological issues. Therefore, it’s important to be aware of the warning signs that could indicate a DDoS attack. One or more of the following symptoms should raise concern:

• A surge in traffic caused by similar devices from the same geographic location or browser
• One or more specific IP addresses making several consecutive requests over a short period of time
• The server times out while being tested for pinging service
• The server responds with a 503 HTTP error, indicating the server is overloaded or down for maintenance
• A traffic analysis shows a strong and consistent spike in traffic
• Traffic logs show spikes at unusual times or in unusual sequences
• Traffic logs show unusually high spikes in traffic to a single endpoint or website

DDoS attacks are a rising threat to organizations. By understanding these attacks how to identify them, organizations can begin the process of protecting themselves against this type of cyberthreat.

Did you know that 60% of small and medium businesses don’t survive after a cyber attack. Protect your business with Cyber Insurance, call us at 780.424.2727 or click here to get a quote.