Threat Bulletin 0148: HTTP GET flood against a online payments platform in Central Europe

On Tuesday 21 September 2021 at 21:32 UTC, a HTTP GET flood targeted a online payments customer in Central Europe. The attack peaked at 455.2 million requests per second and lasted 175 minutes. Traffic originated from 501 autonomous systems in 102 countries, predominantly a rented booter service.

Vector HTTP GET flood
Peak 455.2 million requests per second
Duration 175 min
Time to mitigation 0.896 s
Attack traffic reaching origin 0.040%
Legitimate traffic challenged 0.76%

Timeline

The attack was preceded by a publicly announced sales event. Request rates on the targeted routes exceeded their hourly baseline by a factor of 823 within 39 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.

Recommendations

  • Lower challenge thresholds on authentication endpoints during high-risk events.
  • Add a dedicated rate limit for the targeted route.
  • Enable authenticated origin pulls.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top