On Friday 25 June 2021 at 20:14 UTC, a cache-busting query flood targeted a airline booking customer in Latin America. The attack peaked at 318.6 million requests per second and lasted 66 minutes. Traffic originated from 1503 autonomous systems in 75 countries, predominantly mobile carrier ranges.
| Vector | cache-busting query flood |
| Peak | 318.6 million requests per second |
| Duration | 66 min |
| Time to mitigation | 0.344 s |
| Attack traffic reaching origin | 0.016% |
| Legitimate traffic challenged | 0.02% |
Timeline
The attack was preceded by a publicly announced sales event. Request rates on the targeted routes exceeded their hourly baseline by a factor of 262 within 34 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
A brief increase in p99 latency of 89 ms during the first minute, then normal service.
Recommendations
- Review allow-listed partner ranges quarterly.
- Keep origin IPs out of public DNS history.
- Lower challenge thresholds on authentication endpoints during high-risk events.
How do you avoid challenging uptime monitors and partners?
How do you avoid challenging uptime monitors and partners?
Great to hear, thanks for sharing your experience.
How do you avoid challenging uptime monitors and partners?
The point about origin IPs leaking through certificate transparency logs is underrated.
Thanks! Yes — the risk score and its components are included in every log record.
Interesting that most attacks are under ten minutes. Our experience is similar.
Good question. We will cover that in a follow-up post.
This matches what we see in iGaming around big matches.
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?