On Tuesday 19 July 2022 at 03:25 UTC, a Slowloris targeted a gaming community customer in the Middle East. The attack peaked at 133.2 million requests per second and lasted 22 minutes. Traffic originated from 3901 autonomous systems in 112 countries, predominantly compromised cloud VMs.
| Vector | Slowloris |
| Peak | 133.2 million requests per second |
| Duration | 22 min |
| Time to mitigation | 0.099 s |
| Attack traffic reaching origin | 0.063% |
| Legitimate traffic challenged | 0.27% |
Timeline
The attack was preceded by a ransom note demanding payment in Monero. Request rates on the targeted routes exceeded their hourly baseline by a factor of 578 within 34 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Review allow-listed partner ranges quarterly.
- Enable authenticated origin pulls.
- Keep origin IPs out of public DNS history.
The billing model is what got our finance team on board, honestly.
Interesting that most attacks are under ten minutes. Our experience is similar.
Interesting that most attacks are under ten minutes. Our experience is similar.