On Sunday 16 October 2022 at 17:29 UTC, a Slowloris targeted a electronics retail customer in Southeast Asia. The attack peaked at 54.5 million requests per second and lasted 165 minutes. Traffic originated from 3664 autonomous systems in 46 countries, predominantly compromised cloud VMs.
| Vector | Slowloris |
| Peak | 54.5 million requests per second |
| Duration | 165 min |
| Time to mitigation | 0.471 s |
| Attack traffic reaching origin | 0.042% |
| Legitimate traffic challenged | 0.17% |
Timeline
The attack was preceded by a ransom note demanding payment in Monero. Request rates on the targeted routes exceeded their hourly baseline by a factor of 457 within 12 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.
What the customer saw
The customer’s status page stayed green throughout; they learned about the attack from our notification.
Recommendations
- Enable authenticated origin pulls.
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable log streaming to your SIEM for faster correlation.
Great write-up. We saw almost the same pattern on our login endpoint last month.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.
Machine-readable ranges are at /ips.json and via the API.
Our auditors asked for exactly this kind of incident evidence under DORA.