Threat Bulletin 0318: HTTP POST flood against a B2B SaaS platform in Southeast Asia

On Saturday 14 May 2022 at 11:39 UTC, a HTTP POST flood targeted a B2B SaaS customer in Southeast Asia. The attack peaked at 205.1 million requests per second and lasted 92 minutes. Traffic originated from 1545 autonomous systems in 18 countries, predominantly mobile carrier ranges.

Timeline

The attack was preceded by a hacktivist channel announcing the target. Request rates on the targeted routes exceeded their hourly baseline by a factor of 581 within 26 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

The customer’s status page stayed green throughout; they learned about the attack from our notification.

Recommendations

• Enable authenticated origin pulls.
• Keep origin IPs out of public DNS history.
• Review allow-listed partner ranges quarterly.