This post is about credential stuffing volumes after the latest combo-list leak. It started, as most of our posts do, with an incident that did not go the way we expected.Observability firstEvery…
credential stuffing against a retail banking platform in Iberia, peaking at 67.7 million requests per second. Mitigated in 0.482 seconds.
CLDAP reflection against a sports betting platform in Iberia, peaking at 179.9 Gbps. Mitigated in 0.301 seconds.
HTTP POST flood against a municipal services platform in North America, peaking at 172.4 million requests per second. Mitigated in 0.391 seconds.
Over the last few months we have spent a lot of time on residential proxies are the new botnet. This is what we learned.Why per-route baselines matterA thousand requests per second to…
HTTP/2 rapid reset against a municipal services platform in the Benelux, peaking at 394.5 million requests per second. Mitigated in 0.117 seconds.
cache-busting query flood against a education platform platform in North America, peaking at 895.0 million requests per second. Mitigated in 0.182 seconds.
We get asked about rules engine 2.0: priorities, dry runs and rollbacks more than almost anything else, so here is the long answer.What we changedWe moved the decision from a single threshold…
HTTP GET flood against a gaming community platform in Western Europe, peaking at 914.7 million requests per second. Mitigated in 0.298 seconds.
Here is a question we could not answer well a year ago: what really happens with per-tenant rate limits for SaaS platforms? We can answer it now.Protecting the originNone of this matters…
Rolled out to all points of presence on 26 March 2021. No action is required. New dashboard widget: challenged vs. […]
UDP reflection (NTP) against a video streaming platform in Latin America, peaking at 110.2 Gbps. Mitigated in 0.785 seconds.