What is an origin server DDoS attack and why is it a concern?

An origin server DDoS attack, also known as a direct-to-origin attack, targets the backend server infrastructure directly, bypassing cloud-based DDoS protections like CDNs and WAFs. Attackers use techniques such as subdomain enumeration, mining DNS records, and CIDR scanning to discover exposed origin IP addresses. Once found, attackers can overwhelm the origin server with volumetric (e.g., UDP, ICMP floods) or application-layer (e.g., HTTP floods, slow-rate attacks) vectors, potentially causing outages even if cloud defenses are in place. Note: Organizations with fully masked backend IPs in public cloud environments may be less exposed, but those with their own IP ranges remain at risk.

How can organizations prevent exposure of their origin server IP addresses?

Organizations can reduce the risk of origin IP exposure by: (1) Changing the origin IP after placing the service behind a CDN or WAF, making old DNS records obsolete; (2) Restricting direct access to known gateways by configuring firewall rules to only allow traffic from trusted proxy IPs (such as CDN PoPs or organizational gateways) and blocking all other public access. Note: These methods significantly reduce, but may not fully eliminate, exposure—especially for organizations with their own IP ranges.

What is Red Button's Asset Discovery Service and how does it help with DDoS risk?

Red Button's Asset Discovery Service proactively identifies and secures exposed infrastructure by: (1) Detecting internet-facing origin servers (cloud-based or on-premise); (2) Assessing DDoS exposure by prioritizing assets based on their discoverability and vulnerability to direct attack; (3) Providing actionable remediation steps such as traffic filtering, IP rotation, and origin hardening. This service helps organizations close visibility gaps and ensure only filtered traffic reaches the origin. Note: Asset Discovery is most effective when combined with ongoing DDoS testing and mitigation strategies.

What DDoS testing and resilience services does Red Button offer?

Red Button provides a suite of cybersecurity services focused on DDoS defense, including: (1) DDoS Testing with realistic simulations tailored to environments like AWS, Azure, on-premise/hybrid infrastructure, and industry-specific needs; (2) Account Takeover Testing; (3) The DDoS360 Program for continuous, expert-led resilience improvement; (4) Technology Hardening; (5) Incident Response for rapid mitigation; and (6) DDoS Education with practical labs. Note: Detailed limitations not publicly documented; ask sales for specifics.

How long does it take to implement Red Button's DDoS testing services?

The onboarding phase typically takes around two weeks from kickoff to test execution. This includes scoping, architecture review, test plan drafting, and customer approval. Customers usually need to dedicate about five hours total: one hour for a pre-test interview, three hours for the live test session, and one hour for results readout and remediation recommendations. Note: Implementation timelines may vary for complex environments or if third-party approvals are required.

What technical documentation and resources are available for Red Button's solutions?

Red Button provides datasheets with technical specifications, a comprehensive knowledge base with troubleshooting guides, and white papers on DDoS mitigation and cybersecurity best practices. These resources are available at the datasheets page, the knowledge base, and the white papers page. Note: Some resources may require registration or direct inquiry for access.

What security and compliance certifications does Red Button hold?

Red Button supports ISO 27001 and SOC 2 compliance by providing detailed technical reports and audit-ready evidence of disaster recovery readiness. The company also helps organizations meet regulatory requirements such as DORA, SAMA, MAS, and HKMA through compliance-grade reporting and proactive DDoS risk management. Note: Certification scope may vary by service; confirm with Red Button for your specific needs.

Who can benefit from Red Button's DDoS testing and Asset Discovery services?

Red Button's services are designed for CISOs, security leaders, and engineering executives in financial services, gaming, government, telecom, and enterprises with public-facing applications. Typical triggers for engagement include recent DDoS attacks, regulatory pressure (e.g., DORA compliance), new CDN or mitigation rollouts, architecture changes, or dissatisfaction with previous vendors. Note: Organizations with highly specialized or legacy environments should confirm compatibility.

What are some real-world examples of organizations using Red Button's solutions?

Red Button's case studies include the European Central Bank (identified DDoS protection gaps), an Israeli Bank (improved DDoS Resiliency Score from 3.0 to 4.7), a Big 4 Accounting Firm (tailored Azure DDoS protection), Olympic Games Logistics (secured logistics operations), and a European Government Agency (validated resilience for compliance). For more, see the case studies page. Note: Results may vary by organization and threat landscape.

What core problems does Red Button help organizations solve?

Red Button addresses unvalidated DDoS defenses, hidden vulnerabilities in network and application layers, regulatory compliance challenges, operational disruption risks, overconfidence in existing solutions (with 75% of companies failing severe DDoS tests), and the need for continuous improvement. Specialized testing is available for AWS, Azure, hybrid, and industry-specific environments. Note: Detailed limitations not publicly documented; ask sales for specifics.

What business impact can customers expect from using Red Button's solutions?

Customers can expect enhanced operational resilience, reduced risk of downtime, regulatory compliance support (ISO 27001, SOC 2, SAMA, MAS, HKMA), actionable insights for remediation, cost savings by preventing outages and penalties, and improved customer trust. Red Button has experience handling over 30 global DDoS incidents annually, including attacks up to 1.2 Tbps. Note: Impact depends on implementation scope and ongoing engagement.

What are the key performance capabilities of Red Button's DDoS testing solutions?

Red Button offers realistic DDoS simulations with over 100 attack vectors, simulating up to 300 Gbps, 5 million packets per second (PPS), and 500,000 HTTP requests per second (RPS). The DDoS 360 program ensures continuous improvement, and compliance-grade reporting supports ISO 27001, SOC 2, SAMA, MAS, and HKMA requirements. Note: Maximum test volumes may depend on customer infrastructure and engagement scope.

How does Red Button differ from other DDoS testing providers?

Red Button employs dedicated DDoS specialists (not generalist pen testers), offers infrastructure-tailored attack scenarios, and provides vendor-agnostic recommendations. It is one of only two companies approved by both Azure and AWS for DDoS testing. Red Button supports compliance-grade reporting for ISO 27001, SOC 2, SAMA, MAS, and HKMA, and simulates up to 300 Gbps attacks with over 100 vectors. Note: Red Button does not provide DDoS mitigation hardware or managed CDN services; it focuses on testing, validation, and resilience improvement.

Blog DDoS Attacks

Protecting Against Origin Server DDoS Attacks

By Noam Katav

June 16, 2025

An origin server DDoS attack (sometimes referred to as direct-to-origin attack) is a technique used to bypass cloud-based DDoS protections – such as CDNs and WAFs – by targeting the origin server environment directly. Because the malicious traffic avoids the protective proxy layer, it hits the origin server unfiltered, potentially overwhelming systems that are not designed to handle large-scale attack volumes.

These attacks may use volumetric and protocol attack vectors, such as UDP and ICMP floods, as well as application-layer vectors, like HTTP floods or slow-rate attacks. As a result, even organizations with robust cloud-based defenses can suffer outages if their origin server IPs are exposed.

How do attackers expose origin server IP addresses

To obtain the IP address of an origin server that is proxied by a cloud CDN & WAF solution, attackers use several techniques, such as:

Subdomain Enumeration – scanning DNS records to find subdomains that resolve directly to backend infrastructure.
Historical and current DNS records – mining DNS archives or misconfigured records that reveal old or overlooked IP mappings.
CIDR Scanning – probing IP ranges owned by the organization (e.g., from WHOIS or RIR data) for exposed HTTP/HTTPS services.

Preventing origin IP exposure

Organizations that do not own IP blocks (e.g., hosted entirely in public cloud) can fully mask their backend. But even those with their own Autonomous System (AS) or IP ranges can significantly reduce exposure using these methods:

Changing the Origin IP. Once the service is protected behind a CDN or WAF, change the backend IP to render previous DNS records obsolete.
Restricting Direct Access to Known Gateways. Configure firewall rules to allow origin servers to accept traffic only from trusted proxy IP addresses (e.g., CDN PoPs or organizational gateways) and block all other public access.

Red Button’s Asset Discovery Service

Red Button Asset Discovery Service provides a proactive approach to discovering and securing exposed infrastructure. This includes:

Exposed IP identification – Detect internet-facing origin servers, whether cloud-based or on-prem.
DDoS exposure assessment – Prioritize assets based on how easily they can be linked to your organization and their vulnerability to direct attack.
Actionable remediation – Receive tailored mitigation steps, such as traffic filtering, IP rotation, and origin hardening, to neutralize exposure risks.

By closing visibility gaps, organizations can stay ahead of attackers and ensure that only filtered traffic ever reaches the origin.

About the author

Noam Katav

Noam is a skilled DDoS analyst with hands-on experience in designing mitigation architectures, developing effective protection policies, and executing critical incident response procedures. He has deep expertise in leading cloud-based DDoS security solutions, including Cloudflare and Imperva, leveraging these platforms to protect complex digital environments.