Threat Bulletin 1204: TLS handshake exhaustion against a video streaming platform in Iberia

On Saturday 4 October 2025 at 00:48 UTC, a TLS handshake exhaustion targeted a video streaming customer in Iberia. The attack peaked at 618.4 million requests per second and lasted 162 minutes. Traffic originated from 634 autonomous systems in 77 countries, predominantly a rented booter service.

Timeline

The attack was preceded by a publicly announced sales event. Request rates on the targeted routes exceeded their hourly baseline by a factor of 784 within 27 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

The customer’s status page stayed green throughout; they learned about the attack from our notification.

Recommendations

• Enable log streaming to your SIEM for faster correlation.
• Enable authenticated origin pulls.
• Keep origin IPs out of public DNS history.