On Friday 1 October 2021 at 11:54 UTC, a search endpoint flood targeted a B2B SaaS customer in North America. The attack peaked at 678.3 million requests per second and lasted 10 minutes. Traffic originated from 1660 autonomous systems in 112 countries, predominantly a rented booter service.
| Vector | search endpoint flood |
| Peak | 678.3 million requests per second |
| Duration | 10 min |
| Time to mitigation | 0.039 s |
| Attack traffic reaching origin | 0.073% |
| Legitimate traffic challenged | 0.14% |
Timeline
The attack was preceded by a breaking political story. Request rates on the targeted routes exceeded their hourly baseline by a factor of 713 within 13 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
A brief increase in p99 latency of 193 ms during the first minute, then normal service.
Recommendations
- Keep origin IPs out of public DNS history.
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable log streaming to your SIEM for faster correlation.
Our auditors asked for exactly this kind of incident evidence under DORA.
Solid runbook advice. The DNS-at-2am point hit home.
The billing model is what got our finance team on board, honestly.
Great to hear, thanks for sharing your experience.
How do you avoid challenging uptime monitors and partners?
Any plans to support per-tenant limits keyed on a JWT claim?
Any plans to support per-tenant limits keyed on a JWT claim?
Machine-readable ranges are at /ips.json and via the API.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.
Our auditors asked for exactly this kind of incident evidence under DORA.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.