Threat Bulletin 0642: HTTP POST flood against a crypto exchange platform in Western Europe

On Saturday 12 August 2023 at 06:29 UTC, a HTTP POST flood targeted a crypto exchange customer in Western Europe. The attack peaked at 776.9 million requests per second and lasted 27 minutes. Traffic originated from 1518 autonomous systems in 8 countries, predominantly compromised cloud VMs.

Vector HTTP POST flood
Peak 776.9 million requests per second
Duration 27 min
Time to mitigation 0.237 s
Attack traffic reaching origin 0.070%
Legitimate traffic challenged 0.41%

Timeline

The attack was preceded by a hacktivist channel announcing the target. Request rates on the targeted routes exceeded their hourly baseline by a factor of 317 within 6 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

A brief increase in p99 latency of 21 ms during the first minute, then normal service.

Recommendations

  • Add a dedicated rate limit for the targeted route.
  • Enable authenticated origin pulls.
  • Keep origin IPs out of public DNS history.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top