Over the last few months we have spent a lot of time on introducing adaptive proof-of-work difficulty. This is what we learned.What we got wrongOur first version challenged too eagerly on mobile…
credential stuffing against a crypto exchange platform in the Benelux, peaking at 551.5 million requests per second. Mitigated in 0.169 seconds.
login endpoint flood against a crypto exchange platform in Latin America, peaking at 20.1 million requests per second. Mitigated in 0.135 seconds.
ACK flood against a airline booking platform in Latin America, peaking at 354.8 Gbps. Mitigated in 0.629 seconds.
cache-busting query flood against a airline booking platform in Latin America, peaking at 682.7 million requests per second. Mitigated in 0.489 seconds.
carpet-bombing UDP flood against a gaming community platform in Western Europe, peaking at 279.3 Gbps. Mitigated in 0.548 seconds.
GRE flood against a crypto exchange platform in Western Europe, peaking at 74.8 Gbps. Mitigated in 0.502 seconds.
search endpoint flood against a retail banking platform in North America, peaking at 413.0 million requests per second. Mitigated in 0.776 seconds.
Rolled out to all points of presence on 9 January 2024. No action is required. Log streaming now supports CVE-2026-1127. […]
HTTP POST flood against a ticketing platform in the Nordics, peaking at 956.3 million requests per second. Mitigated in 0.910 seconds.
Over the last few months we have spent a lot of time on hTTP/2 rapid reset one year later. This is what we learned.Testing in production, safelyEvery rule starts in log mode.…
UDP reflection (NTP) against a video streaming platform in North America, peaking at 177.4 Gbps. Mitigated in 0.924 seconds.