On Friday 18 April 2025 at 02:41 UTC, a login endpoint flood targeted a ticketing customer in Western Europe. The attack peaked at 518.1 million requests per second and lasted 144 minutes. Traffic originated from 2883 autonomous systems in 25 countries, predominantly a Mirai-derived IoT botnet.
| Vector | login endpoint flood |
| Peak | 518.1 million requests per second |
| Duration | 144 min |
| Time to mitigation | 0.493 s |
| Attack traffic reaching origin | 0.050% |
| Legitimate traffic challenged | 0.25% |
Timeline
The attack was preceded by an extortion email received two days earlier. Request rates on the targeted routes exceeded their hourly baseline by a factor of 131 within 22 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
A brief increase in p99 latency of 80 ms during the first minute, then normal service.
Recommendations
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Keep origin IPs out of public DNS history.
- Review allow-listed partner ranges quarterly.
How do you avoid challenging uptime monitors and partners?
Clear and practical, thanks.
Great to hear, thanks for sharing your experience.
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
The point about origin IPs leaking through certificate transparency logs is underrated.
The point about origin IPs leaking through certificate transparency logs is underrated.
Verified good bots and allow-listed partners bypass challenges entirely.
Would love a follow-up on how you handle HTTP/3 fingerprinting.
Great to hear, thanks for sharing your experience.
The point about origin IPs leaking through certificate transparency logs is underrated.
Verified good bots and allow-listed partners bypass challenges entirely.
Would love a follow-up on how you handle HTTP/3 fingerprinting.
Machine-readable ranges are at /ips.json and via the API.