TLS handshake exhaustion against a education platform platform in the Middle East, peaking at 697.0 million requests per second. Mitigated in 0.182 seconds.
We get asked about what to put in your DDoS runbook more than almost anything else, so here is the long answer.What we changedWe moved the decision from a single threshold to…
We get asked about botnets built from misconfigured IoT cameras, again more than almost anything else, so here is the long answer.The economics behind itA booter service rents out a 100 Gbps…
why we wrote our proxy data plane in Rust sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Latency budgetOur budget…
cache-busting query flood against a developer platform platform in Latin America, peaking at 727.5 million requests per second. Mitigated in 0.146 seconds.
Here is a question we could not answer well a year ago: what really happens with rate limiting APIs without breaking legitimate integrations? We can answer it now.Protecting the originNone of this…
We get asked about nIS2 and availability: a plain-language summary more than almost anything else, so here is the long answer.Protecting the originNone of this matters if the attacker can reach your…
Rolled out to all points of presence on 13 June 2025. No action is required. Log streaming now supports Safari […]
carpet-bombing UDP flood against a news publisher platform in Iberia, peaking at 151.2 Gbps. Mitigated in 0.804 seconds.
WebSocket connection flood against a ticketing platform in the Middle East, peaking at 542.0 million requests per second. Mitigated in 0.588 seconds.
SYN flood against a developer platform platform in Western Europe, peaking at 211.2 Gbps. Mitigated in 0.039 seconds.
Rolled out to all points of presence on 29 December 2024. No action is required. API: new endpoint CVE-2026-1127. New […]