On Sunday 4 January 2026 at 14:39 UTC, a login endpoint flood targeted a developer platform customer in Iberia. The attack peaked at 860.7 million requests per second and lasted 12 minutes. Traffic originated from 2938 autonomous systems in 112 countries, predominantly a headless-browser farm.
| Vector | login endpoint flood |
| Peak | 860.7 million requests per second |
| Duration | 12 min |
| Time to mitigation | 0.782 s |
| Attack traffic reaching origin | 0.083% |
| Legitimate traffic challenged | 0.47% |
Timeline
The attack was preceded by no stated motive. Request rates on the targeted routes exceeded their hourly baseline by a factor of 105 within 16 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
A brief increase in p99 latency of 180 ms during the first minute, then normal service.
Recommendations
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Add a dedicated rate limit for the targeted route.
- Enable log streaming to your SIEM for faster correlation.
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
Clear and practical, thanks.
The point about origin IPs leaking through certificate transparency logs is underrated.
The billing model is what got our finance team on board, honestly.
Thanks — sharing this with our on-call team.
Great to hear, thanks for sharing your experience.
Nice to read a vendor blog that admits what went wrong.