Why most layer 7 attacks last less than ten minutes
Over the last few months we have spent a lot of time on why most layer 7 attacks last less than ten minutes. This is what we learned.Observability firstEvery mitigation decision is…
Introducing adaptive proof-of-work difficulty
This post is about introducing adaptive proof-of-work difficulty. It started, as most of our posts do, with an incident that did not go the way we expected.The numbersAcross the last quarter, 71%…
Extortion DDoS campaigns target payment providers again (part 4)
extortion DDoS campaigns target payment providers again sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Observability firstEvery mitigation decision is…
Why attackers love login endpoints (part 2)
Here is a question we could not answer well a year ago: what really happens with why attackers love login endpoints? We can answer it now.What we changedWe moved the decision from…
Attacks are never metered: why we changed how we bill (part 4)
We get asked about attacks are never metered: why we changed how we bill more than almost anything else, so here is the long answer.The economics behind itA booter service rents out…
How we deploy rule changes to every edge in under 30 seconds (part 4)
This post is about how we deploy rule changes to every edge in under 30 seconds. It started, as most of our posts do, with an incident that did not go the…
Tail latency is the only latency that matters (part 2)
We get asked about tail latency is the only latency that matters more than almost anything else, so here is the long answer.Latency budgetOur budget for the whole filtering pipeline is one…
How we test WAF rules against seven days of real traffic (part 4)
how we test WAF rules against seven days of real traffic sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Latency…
Log streaming to your SIEM, now in near real time (part 2)
We get asked about log streaming to your SIEM, now in near real time more than almost anything else, so here is the long answer.What actually happens during a floodThe first thing…
QUIC and HTTP/3 at the edge: what changes for DDoS mitigation
This post is about qUIC and HTTP/3 at the edge: what changes for DDoS mitigation. It started, as most of our posts do, with an incident that did not go the way…
The hidden cost of retries during a flood (part 4)
Over the last few months we have spent a lot of time on the hidden cost of retries during a flood. This is what we learned.Latency budgetOur budget for the whole filtering…
Residential proxies are the new botnet
We get asked about residential proxies are the new botnet more than almost anything else, so here is the long answer.Lessons for your own runbookKnow who can change DNS at two in…