On Monday 16 May 2022 at 16:56 UTC, a Slowloris targeted a crypto exchange customer in the Benelux. The attack peaked at 895.7 million requests per second and lasted 139 minutes. Traffic originated from 3510 autonomous systems in 50 countries, predominantly hijacked home routers.
| Vector | Slowloris |
| Peak | 895.7 million requests per second |
| Duration | 139 min |
| Time to mitigation | 0.658 s |
| Attack traffic reaching origin | 0.065% |
| Legitimate traffic challenged | 0.09% |
Timeline
The attack was preceded by a hacktivist channel announcing the target. Request rates on the targeted routes exceeded their hourly baseline by a factor of 598 within 35 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
A brief increase in p99 latency of 156 ms during the first minute, then normal service.
Recommendations
- Review allow-listed partner ranges quarterly.
- Enable log streaming to your SIEM for faster correlation.
- Add a dedicated rate limit for the targeted route.
Nice to read a vendor blog that admits what went wrong.
The point about origin IPs leaking through certificate transparency logs is underrated.
Thanks — sharing this with our on-call team.
Could you share the dataset behind the percentages?
Good question. We will cover that in a follow-up post.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
The point about origin IPs leaking through certificate transparency logs is underrated.
Interesting that most attacks are under ten minutes. Our experience is similar.
Do you publish the edge IP ranges in a machine-readable format?
Our auditors asked for exactly this kind of incident evidence under DORA.
Machine-readable ranges are at /ips.json and via the API.