How to protect yourself from DDoS attacks in online gambling

Online casinos are an attractive target for DDoS: peak tournaments, live tables, sensitive payments and strict SLAs. Attacks hit revenue, reputation and license. Effective protection is not one "anti-mitigator," but a layered architecture: from BGP Anycast and scrubbing to competent cache, WAF rules, bot control and response plans.

1) Attack types and why they are dangerous for iGaming

L3/4 (volumetric): UDP/ICMP/UDP-reflection, SYN/ACK flood - clog the channel and balancers.

L7 (app): HTTP-flood, cache-busting, Slowloris/slow-POST, WebSocket storm, GraphQL/search endpoints.

Point hits on business critical areas: cash desk/payments, KYC downloads, tournament tables API, live-HLS/DASH, WebSocket buses.

Mix attacks: parallel L3/4 + L7, vector switching when trying to filter.

2) Basic durability architecture (layers)

1. Edge/Anycast/CDN: A global Anycast and scrubbing network to resorb traffic near the edge.

2. WAF/bot management: signatures, behavioral models, JS challenges and device fingerprinting.

3. LB/Origin Shield: L4/L7 balancers, private origins behind the allow-list IP CDN.

4. Application: cache first render, cheap answers to expensive requests, idempotence.

5. Data/queues: back-pressure, queues and degradation modes for cash desk/ACC.

6. Observability: NetFlow/sFlow, WAF logs, L4/L7 metrics, SIEM/alerts.

7. Orchestration and IR: auto-scaling, feature flags, "kill switches," runbook 'and.

3) Network Perimeter: BGP Anycast and Scrubbing

Increase protection from a provider with global scrubbing centers and Anycast load transfer.

BGP-black holes (RTBH )/flowspec - as a last resort for discard/dynamic filtering.

NTP/DNS/SSDP-reflection - filtered on edge; Add filters on your own UDP services.

4) L7 defence: WAF and bot control

Rules for expensive endpoints: search, multiresize images, graph queries, export. Limit body settings, depth, and size.

Challenges without captcha pain: invisible checks (JS integration, timing, device, behavioral speed), and captcha - only for gray areas.

Per-ASN/per-geo quotas: don't choke all traffic - cut "suspicious islands."

Dynamic denylist/allowlist: automatic for 5-30 minutes on behavioral metrics.

5) Rate-limit and queues (prevent the application from choking)

Token Bucket/Leaky Bucket on IP/Token/Session/ASN. Different limits for:

public content (high), balance/bid API (strict), LCC/downloads (low parallelism, queues).
Server-side queues + waiting pages for bursts.
Timeouts and circuit breakers in microservices so that the attack does not drop the entire graph.

6) Cash strategies and cheap answers

Static & edge-cache: lobby, storefronts, WebGL/audio assets - we cache with versioning.

Micro-cache (1-10 sec) for "near-dynamics" (ratings, banners).

Stale-while-revalidate: give up the "old" when overloaded.

Cache keys versus cache-busting: normalize parameters, cut garbage query lines.

7) Live video and WebSocket

HLS/DASH: a lot of CDN-edge, short segments, prefetch, protection against frequent 404.

WebSocket: rate-limit to establish, heartbeat-control, auto-closing of "quiet" connections, translation to SSE in case of anomalies.

8) Payments and KYC: separate circuit

Isolate the cash desk and KYC behind WAF + IP-allow-list providers (PSP/KYC).

webhooks signatures (HMAC) and anti-replay; redelivery with deduplication.

Money idempotency: 'Idempotency-Key', unique 'txn _ id', sagas/compensations - the attack should not create a double payout.

Degrade mode: with DDoS - temporarily disable "heavy" methods (instant outputs), leaving deposits/balance.

9) API and Application Design

Hard validation (body sizes, JSON schemes, prohibition of "explosive" filters).

Default paging and limits.

GraphQL: prohibitions on "super-depth," cost-analysis.

WebGL/client: exponential retrays with jitter, off-switch animations, graceful-degradation for network errors.

10) Scalability and fault tolerance

Asset regions with a global traffic manager; rapid evacuation switching.

Autoscale via RPS/CPU/connections; heated spare nodes.

Origin Shield and private subnets; only traffic from the IP CDN/Scrabber.

Feature Flags/kill switch for heavy features (tournaments, widgets) to instantly cut the load.

11) Observability and telemetry

NetFlow/sFlow from provider + WAF/edge logs → SIEM/UEBA.

Dashboards: p95/p99 latency, open connections, 4xx/5xx routes, establish-rate WebSocket/HTTP/2.

Early signals: SYN growth without ACK, surge 499/408, ASN/geo anomalies, "long" LCC/payment queues.

12) Response Procedures (IR) and Communications

Runbook: Who declares incident, who switches region, who speaks to PSP and regulator.

Single status window: status page for players/affiliates (not on the same domain!).

Legal steps: recording in SIEM, requests to providers/ASOs, prepared letters to the regulator (if SLAs are violated).

Post-sea: retrospective, changes to WAF rules, updating deny/allow lists and auto-alerts.

13) Frequent errors

One security provider for everything. We need a "belt and braces": CDN + scrubbing + WAF + cloud LB.

There is no separate outline for cash register/cash register. Vulnerable points hit first.

Weak cache/no micro-cache. Any L7 flood becomes expensive at origin.

Lack of money idempotency. DDoS turns into financial incidents.

Unlimited web sockets. Thousands of "empty" connections hold resources.

Single region. There is nowhere to switch → a long downtime.

14) Quick readiness checklist (save)

Anycast CDN + Scrubbing connected, RTBH/flowspec agreed with provider
WAF/bot management with rules for expensive endpoints, per-ASN quotas
Rate-limit (IP/token/ASN), queues and waiting pages
Micro-cache + stale-while-revalidate, parameter normalization
WebSocket limits and fallback on SSE
Cash desk/CCM isolated, webhooks with HMAC and anti-replay
Money idempotence, sagas and deduplication
Active-active regions, origin shield, allow-list IP edge
SIEM + NetFlow, alerts on SYN-rate/5xx/499, dashboard p95/p99
Runbook/roles and status page outside the primary domain

15) Mini-FAQ

Does DDoS affect RNG/RTP? Not if infrastructure is isolated; perceived "injustice" is growing due to lags - protect L7.

Do I always need a captcha? Use smart challenges and behavior; Captcha - only for gray areas, taking into account accessibility.

Cloud vs on-prem? Hybrid: edge scrubbing in the cloud + private origins/wallet in an isolated perimeter.

How much to keep micro-cache? 1-10 seconds on hot pages - radically reduces the cost of floods.

DDoS protection in online gambling is a discipline of architecture and processes: distribute traffic at the edge, reduce the cost of each byte of the request, isolate the cashier/CCM, enable observability and have a switching plan. The combination of Anycast + scrubbing, smart WAF/bot control, cache and active-active topology turns even powerful attacks into controlled incidents and retains the trust of players, partners and regulators.