On Sunday 15 June 2025 at 01:48 UTC, a TLS handshake exhaustion targeted a education platform customer in Latin America. The attack peaked at 71.8 million requests per second and lasted 168 minutes. Traffic originated from 2472 autonomous systems in 108 countries, predominantly misconfigured open reflectors.
| Vector | TLS handshake exhaustion |
| Peak | 71.8 million requests per second |
| Duration | 168 min |
| Time to mitigation | 0.020 s |
| Attack traffic reaching origin | 0.055% |
| Legitimate traffic challenged | 0.33% |
Timeline
The attack was preceded by no stated motive. Request rates on the targeted routes exceeded their hourly baseline by a factor of 138 within 29 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
A brief increase in p99 latency of 55 ms during the first minute, then normal service.
Recommendations
- Enable authenticated origin pulls.
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Add a dedicated rate limit for the targeted route.
This matches what we see in iGaming around big matches.
Solid runbook advice. The DNS-at-2am point hit home.
Great write-up. We saw almost the same pattern on our login endpoint last month.
Solid runbook advice. The DNS-at-2am point hit home.
Carpet bombing is nasty. Good to see a clear explanation of it.
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
Could you share the dataset behind the percentages?
This matches what we see in iGaming around big matches.