Threat Bulletin 0127: login endpoint flood against a electronics retail platform in the Nordics

On Saturday 21 August 2021 at 14:49 UTC, a login endpoint flood targeted a electronics retail customer in the Nordics. The attack peaked at 684.6 million requests per second and lasted 185 minutes. Traffic originated from 2556 autonomous systems in 9 countries, predominantly a Mirai-derived IoT botnet.

Vector login endpoint flood
Peak 684.6 million requests per second
Duration 185 min
Time to mitigation 0.377 s
Attack traffic reaching origin 0.042%
Legitimate traffic challenged 0.14%

Timeline

The attack was preceded by a breaking political story. Request rates on the targeted routes exceeded their hourly baseline by a factor of 212 within 22 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

Checkout conversion was unchanged compared with the same hour of the previous week.

Recommendations

  • Keep origin IPs out of public DNS history.
  • Lower challenge thresholds on authentication endpoints during high-risk events.
  • Review allow-listed partner ranges quarterly.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top