FortiAppSec Cloud incident

[Service Outage Notice] Europe Regions – AWS EU Central (Frankfurt) Scrubbing Servers Down.

Critical Resolved View vendor source →

FortiAppSec Cloud experienced a critical incident on June 15, 2026 affecting WAF Scrubbing Region - AWS - EU (Frankfurt), lasting 2d 15h. The incident has been resolved; the full update timeline is below.

Started
Jun 15, 2026, 07:29 AM UTC
Resolved
Jun 17, 2026, 10:43 PM UTC
Duration
2d 15h
Detected by Pingoru
Jun 15, 2026, 07:29 AM UTC

Affected components

WAF Scrubbing Region - AWS - EU (Frankfurt)

Update timeline

  1. investigating Jun 15, 2026, 07:29 AM UTC

    We are currently investigating this issue.

  2. investigating Jun 15, 2026, 07:42 AM UTC

    We are continuing to investigate this issue.

  3. investigating Jun 15, 2026, 07:54 AM UTC

    We are continuing to investigate this issue.

  4. identified Jun 15, 2026, 08:55 AM UTC

    Normally lb-3.eu-central-1.aws.waas-online.net has IP addresses 35.157.26.13 and 18.153.162.82. Currently the two nodes are under attack and they are not serving well. We have brought up nodes 3.71.235.211 and 3.73.142.131 and redirect lb-3.eu-central-1.aws.waas-online.net to the new nodes. Applications using CNAME records should be OK now. Applications using A records should change to 3.71.235.211 and 3.73.142.131 for better service.

  5. monitoring Jun 15, 2026, 02:41 PM UTC

    The attacks are blocked. The original node are OK for several hours. Please recover your app's A records back to 35.157.26.13 and 18.153.162.82 if you have changed them to the new nodes. Nothing needs to be done for the applications using CNAME records.

  6. investigating Jun 16, 2026, 08:39 AM UTC

    We are currently investigating this issue.

  7. monitoring Jun 16, 2026, 12:24 PM UTC

    A fix has been implemented and we are monitoring the results.

  8. monitoring Jun 17, 2026, 11:24 AM UTC

    We have successfully mitigated the DDoS attack, and traffic has now stabilized. Application using A records of 3.71.235.211 and/or 3.73.142.131 should change back to 35.157.26.13 and 18.153.162.82. We'll arrange to bring down the dynamic nodes (3.71.235.211 and 3.73.142.131).

  9. resolved Jun 17, 2026, 10:43 PM UTC

    The affected scrubbing servers have recovered and health checks have remained stable during the monitoring period. This incident is now resolved.