Threat Bulletin 0361: HTTP GET flood against a news publisher platform in North America

On Wednesday 13 July 2022 at 20:41 UTC, a HTTP GET flood targeted a news publisher customer in North America. The attack peaked at 572.6 million requests per second and lasted 66 minutes. Traffic originated from 4027 autonomous systems in 33 countries, predominantly a Mirai-derived IoT botnet.

Vector HTTP GET flood
Peak 572.6 million requests per second
Duration 66 min
Time to mitigation 0.258 s
Attack traffic reaching origin 0.046%
Legitimate traffic challenged 0.39%

Timeline

The attack was preceded by no stated motive. Request rates on the targeted routes exceeded their hourly baseline by a factor of 622 within 8 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

Checkout conversion was unchanged compared with the same hour of the previous week.

Recommendations

  • Lower challenge thresholds on authentication endpoints during high-risk events.
  • Enable authenticated origin pulls.
  • Enable log streaming to your SIEM for faster correlation.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top