● E-commerce·gaming
Root-cause analysis of a DDoS·breach and a rebuilt defense system
Pinned down the root cause of DDoS·hacking attempts and rebuilt the defense, from detection through response.
incident-free
since the rebuild
24/7
automated detection·response
● THE CHALLENGE
Why it was hard.
Repeated DDoS and intrusion attempts shook the service, but the team kept blocking ad hoc without pinning down the cause. Defense was scattered, so the same attack came back in a new shape. They needed a system, not one-off blocks.
Constraints
- Respond live — keep availability
- Root cause first
- A standing system that prevents recurrence
● OUR APPROACH
What we did.
- Incident analysisTrace logs, traffic, and intrusion paths to the root cause
- Defense designWAF, rate limiting, network boundaries, least privilege
- Automated detection·responseAnomaly detection with automatic blocking and alerts
- Standing operationsDrills and regular reviews keep the system sharp
● OUTCOME
Outcome.
Ad hoc blocking became a standing defense that starts from root cause. We built boundaries and detection so the same attack can't recur, and it has run incident-free since — detecting and responding to attacks 24/7.
● RELATED INSIGHT
The detailed record, from diagnosis through execution.
Where does website blocking happen? Reading DNS, SNI, and CDN controlsEngineering deep dives · Updated July 18, 2026Map South Korean website controls across DNS, IP, SNI, and CDN layers, with July 2026 DoH, DoT, and ECH support and international cases.→
Does encrypting SNI put traffic beyond control? Hiding ends at the CDNEngineering deep dives · Updated July 16, 2026ECH hides the destination domain from observers on the path, but it cannot change the policy decision of the endpoint that decrypts it: the CDN. How SNI and ECH work, which network layer controls what, and how the failure fingerprints differ.→
Should you chase an agent-readiness score? From Level 1 to Agent-NativeEngineering deep dives · Updated July 16, 2026isitagentready.com scored our site 29, Level 1. Instead of filling the scorecard, we filtered by substance: Content Signals, markdown negotiation, a real MCP server, DNS-AID and DNSSEC — reaching 71, Level 5 (Agent-Native). And a hard look at what agent scores actually measure.→
● STACK
Stack.
AWS WAFShieldCloudFrontGuardDutySIEM
● RELATED CASES
More work from this service.
- ↳H100 GPU self-service orchestration portalMajor university hospital · healthcareTurned a manually-coordinated H100 cluster into a Kueue self-service portal. 2× utilization, 18 months zero downtime.→
- ↳Cost & performance turnaround on an undocumented legacy systemFinance·fintechReverse-engineered a system whose owners had left and whose docs were gone, then stopped the cost leaks and bottlenecks.→
● RELATED SERVICE
Explore Cloud & Infrastructure →Got a similar challenge? Let's talk it through, case in hand.
In 30 minutes we'll pin down what matches and what differs.
● Already trusted by teams across finance · healthcare · media · public