We get asked about protecting WordPress login and XML-RPC from abuse more than almost anything else, so here is the long answer.Challenges beat blocksBlocking lists go stale within minutes when attackers rotate…
Here is a question we could not answer well a year ago: what really happens with choosing between DNS delegation and CNAME onboarding? We can answer it now.What we changedWe moved the…
ACK flood against a online casino platform in the Nordics, peaking at 15.6 Gbps. Mitigated in 0.489 seconds.
Rolled out to all points of presence on 4 July 2023. No action is required. Managed WAF: 23 new signatures […]
Over the last few months we have spent a lot of time on carpet bombing: spreading an attack across a whole /22. This is what we learned.Latency budgetOur budget for the whole…
search endpoint flood against a tax authority portal platform in the Nordics, peaking at 870.9 million requests per second. Mitigated in 0.312 seconds.
cache-busting query flood against a healthcare portal platform in the Middle East, peaking at 492.9 million requests per second. Mitigated in 0.572 seconds.
HTTP POST flood against a airline booking platform in North America, peaking at 565.6 million requests per second. Mitigated in 0.829 seconds.
search endpoint flood against a education platform platform in the Nordics, peaking at 84.5 million requests per second. Mitigated in 0.877 seconds.
credential stuffing against a online payments platform in Iberia, peaking at 432.0 million requests per second. Mitigated in 0.934 seconds.
HTTP GET flood against a education platform platform in Latin America, peaking at 741.7 million requests per second. Mitigated in 0.222 seconds.
HTTP/2 rapid reset against a ticketing platform in the UK, peaking at 978.0 million requests per second. Mitigated in 0.056 seconds.