Threat Bulletin 0183: search endpoint flood against a gaming community platform in the Nordics
search endpoint flood against a gaming community platform in the Nordics, peaking at 694.3 million requests per second. Mitigated in 0.828 seconds.
residential-proxies
Credential stuffing volumes after the latest combo-list leak (part 3)
This post is about credential stuffing volumes after the latest combo-list leak. It started, as most of our posts do, with an incident that did not go the way we expected.Observability firstEvery…
Threat Bulletin 0175: WebSocket connection flood against a airline booking platform in the Middle East
WebSocket connection flood against a airline booking platform in the Middle East, peaking at 674.8 million requests per second. Mitigated in 0.264 seconds.
Measuring the real cost of a TLS handshake under attack (part 3)
Over the last few months we have spent a lot of time on measuring the real cost of a TLS handshake under attack. This is what we learned.Observability firstEvery mitigation decision is…
Threat Bulletin 0087: ACK flood against a news publisher platform in the Middle East
ACK flood against a news publisher platform in the Middle East, peaking at 233.5 Gbps. Mitigated in 0.225 seconds.
Building a per-route baseline without storing every request (part 2)
building a per-route baseline without storing every request sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Challenges beat blocksBlocking lists…
Threat Bulletin 0047: UDP reflection (NTP) against a online payments platform in the Benelux
UDP reflection (NTP) against a online payments platform in the Benelux, peaking at 197.9 Gbps. Mitigated in 0.244 seconds.
Threat Bulletin 0044: Slowloris against a municipal services platform in Iberia
Slowloris against a municipal services platform in Iberia, peaking at 645.3 million requests per second. Mitigated in 0.213 seconds.
Per-tenant rate limits for SaaS platforms (part 2)
Here is a question we could not answer well a year ago: what really happens with per-tenant rate limits for SaaS platforms? We can answer it now.Protecting the originNone of this matters…
Threat Bulletin 0011: credential stuffing against a education platform platform in Southeast Asia
credential stuffing against a education platform platform in Southeast Asia, peaking at 319.9 million requests per second. Mitigated in 0.455 seconds.