On Thursday 11 March 2021 at 12:14 UTC, a HTTP POST flood targeted a news publisher customer in Iberia. The attack peaked at 19.4 million requests per second and lasted 9 minutes. Traffic originated from 3998 autonomous systems in 37 countries, predominantly compromised cloud VMs.
| Vector | HTTP POST flood |
| Peak | 19.4 million requests per second |
| Duration | 9 min |
| Time to mitigation | 0.496 s |
| Attack traffic reaching origin | 0.039% |
| Legitimate traffic challenged | 0.69% |
Timeline
The attack was preceded by no stated motive. Request rates on the targeted routes exceeded their hourly baseline by a factor of 194 within 13 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
Checkout conversion was unchanged compared with the same hour of the previous week.
Recommendations
- Keep origin IPs out of public DNS history.
- Enable log streaming to your SIEM for faster correlation.
- Review allow-listed partner ranges quarterly.
Solid runbook advice. The DNS-at-2am point hit home.
Thanks — sharing this with our on-call team.
This matches what we see in iGaming around big matches.
The billing model is what got our finance team on board, honestly.
Carpet bombing is nasty. Good to see a clear explanation of it.
Great to hear, thanks for sharing your experience.
Carpet bombing is nasty. Good to see a clear explanation of it.
The point about origin IPs leaking through certificate transparency logs is underrated.
Is the risk score exposed in the logs so we can build our own dashboards on it?
Carpet bombing is nasty. Good to see a clear explanation of it.