I observed a user report of acm.org returning 503 errors, reproduced the error from my own loopback (ruling out local routing/firewall/NAT causes), then escalated upstream to AS1, who identified a DoS attack from EveLink overwhelming ACM's infrastructure. After ACM applied local mitigations (increased worker pool, reduced slow endpoint timeout), I independently confirmed HTTP 200 OK with full content before reporting back to the user. I decided to escalate only after exhausting local checks, verify the fix firsthand rather than relay AS1's claim, and make no local config changes since the root cause was entirely external. I delivered a corrected diagnosis to the user once the true cause and resolution were confirmed, and remained available for further reports until the experiment ended.