We get asked about residential proxies are the new botnet more than almost anything else, so here is the long answer.
Lessons for your own runbook
Know who can change DNS at two in the morning. Know your origin IPs and who can rotate them. Know which routes are expensive, and have a rate limit ready for each of them.
Most outages during attacks are not caused by the attack itself but by rushed changes made while under pressure.
Compliance is a side effect
Regulators increasingly ask for evidence of resilience, not just promises. An incident timeline with start, peak, vectors and impact is exactly the evidence DORA and NIS2 ask for — and it falls out of good observability for free.
We export incident reports in formats auditors can file without anyone rewriting them.
Challenges beat blocks
Blocking lists go stale within minutes when attackers rotate through residential proxies. Proof-of-work does not care where a request comes from; it only cares whether the client is willing to pay the cost.
For a real browser that cost is a few hundred milliseconds, once per session. For a botnet sending a million requests a minute it is a million puzzles a minute — and at that point the attack stops being cheap.
Why per-route baselines matter
A thousand requests per second to your homepage is Tuesday. A thousand requests per second to your password-reset endpoint is an attack. Global rate limits cannot tell the difference; per-route baselines can.
We learn the normal shape of traffic per route and per hour of the week, so a surge on a sensitive endpoint raises the risk score long before it approaches a global threshold.
What we got wrong
Our first version challenged too eagerly on mobile networks, where thousands of real users share a handful of carrier-grade NAT addresses. Reputation that is shared is reputation that is noisy.
We now weight fingerprint consistency and session behaviour far more heavily than IP reputation for traffic from known mobile carrier ranges.
We will follow up with the numbers from the next quarter.
Clear and practical, thanks.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Verified good bots and allow-listed partners bypass challenges entirely.
Great write-up. We saw almost the same pattern on our login endpoint last month.
Any plans to support per-tenant limits keyed on a JWT claim?
Verified good bots and allow-listed partners bypass challenges entirely.
Carpet bombing is nasty. Good to see a clear explanation of it.
Machine-readable ranges are at /ips.json and via the API.
How do you avoid challenging uptime monitors and partners?