Threat Bulletin 0628: HTTP GET flood against a ticketing platform in Southeast Asia

On Saturday 22 July 2023 at 18:37 UTC, a HTTP GET flood targeted a ticketing customer in Southeast Asia. The attack peaked at 178.9 million requests per second and lasted 37 minutes. Traffic originated from 3220 autonomous systems in 96 countries, predominantly a headless-browser farm.

Vector HTTP GET flood
Peak 178.9 million requests per second
Duration 37 min
Time to mitigation 0.266 s
Attack traffic reaching origin 0.065%
Legitimate traffic challenged 0.02%

Timeline

The attack was preceded by a hacktivist channel announcing the target. Request rates on the targeted routes exceeded their hourly baseline by a factor of 649 within 8 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

A brief increase in p99 latency of 171 ms during the first minute, then normal service.

Recommendations

  • Enable log streaming to your SIEM for faster correlation.
  • Add a dedicated rate limit for the targeted route.
  • Keep origin IPs out of public DNS history.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top