On Monday 23 June 2025 at 06:02 UTC, a TLS handshake exhaustion targeted a online casino customer in Iberia. The attack peaked at 78.1 million requests per second and lasted 48 minutes. Traffic originated from 3691 autonomous systems in 100 countries, predominantly compromised cloud VMs.
| Vector | TLS handshake exhaustion |
| Peak | 78.1 million requests per second |
| Duration | 48 min |
| Time to mitigation | 0.320 s |
| Attack traffic reaching origin | 0.089% |
| Legitimate traffic challenged | 0.27% |
Timeline
The attack was preceded by no stated motive. Request rates on the targeted routes exceeded their hourly baseline by a factor of 251 within 14 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Review allow-listed partner ranges quarterly.
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable log streaming to your SIEM for faster correlation.
Thanks — sharing this with our on-call team.
This matches what we see in iGaming around big matches.
Verified good bots and allow-listed partners bypass challenges entirely.
Could you share the dataset behind the percentages?
Verified good bots and allow-listed partners bypass challenges entirely.
Thanks — sharing this with our on-call team.
Would love a follow-up on how you handle HTTP/3 fingerprinting.
The billing model is what got our finance team on board, honestly.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.