On Tuesday 1 November 2022 at 20:05 UTC, a login endpoint flood targeted a B2B SaaS customer in Southeast Asia. The attack peaked at 170.8 million requests per second and lasted 133 minutes. Traffic originated from 1816 autonomous systems in 27 countries, predominantly hijacked home routers.
| Vector | login endpoint flood |
| Peak | 170.8 million requests per second |
| Duration | 133 min |
| Time to mitigation | 0.709 s |
| Attack traffic reaching origin | 0.074% |
| Legitimate traffic challenged | 0.04% |
Timeline
The attack was preceded by a breaking political story. Request rates on the targeted routes exceeded their hourly baseline by a factor of 118 within 40 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
A brief increase in p99 latency of 105 ms during the first minute, then normal service.
Recommendations
- Enable authenticated origin pulls.
- Review allow-listed partner ranges quarterly.
- Lower challenge thresholds on authentication endpoints during high-risk events.
Great write-up. We saw almost the same pattern on our login endpoint last month.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
The point about origin IPs leaking through certificate transparency logs is underrated.
Thanks — sharing this with our on-call team.