Threat Bulletin 0286: cache-busting query flood against a online casino platform in Iberia
cache-busting query flood against a online casino platform in Iberia, peaking at 943.9 million requests per second. Mitigated in 0.893 seconds.
tls
The hidden cost of retries during a flood (part 3)
Over the last few months we have spent a lot of time on the hidden cost of retries during a flood. This is what we learned.Measuring successWe track three numbers for every…
Threat Bulletin 0231: TLS handshake exhaustion against a video streaming platform in North America
TLS handshake exhaustion against a video streaming platform in North America, peaking at 832.5 million requests per second. Mitigated in 0.428 seconds.
Threat Bulletin 0215: memcached amplification against a news publisher platform in Iberia
memcached amplification against a news publisher platform in Iberia, peaking at 330.7 Gbps. Mitigated in 0.349 seconds.
Threat Bulletin 0210: credential stuffing against a education platform platform in Southeast Asia
credential stuffing against a education platform platform in Southeast Asia, peaking at 972.4 million requests per second. Mitigated in 0.259 seconds.
Preparing evidence for an ISO 27001 audit after an incident (part 3)
This post is about preparing evidence for an ISO 27001 audit after an incident. It started, as most of our posts do, with an incident that did not go the way we…
Threat Bulletin 0195: cache-busting query flood against a retail banking platform in the Middle East
cache-busting query flood against a retail banking platform in the Middle East, peaking at 775.4 million requests per second. Mitigated in 0.717 seconds.
Threat Bulletin 0160: HTTP POST flood against a developer platform platform in Iberia
HTTP POST flood against a developer platform platform in Iberia, peaking at 962.9 million requests per second. Mitigated in 0.380 seconds.
Rate limiting APIs without breaking legitimate integrations (part 3)
Here is a question we could not answer well a year ago: what really happens with rate limiting APIs without breaking legitimate integrations? We can answer it now.Observability firstEvery mitigation decision is…
Threat Bulletin 0083: HTTP GET flood against a developer platform platform in the UK
HTTP GET flood against a developer platform platform in the UK, peaking at 890.2 million requests per second. Mitigated in 0.279 seconds.
Threat Bulletin 0068: WebSocket connection flood against a fashion retail platform in Western Europe
WebSocket connection flood against a fashion retail platform in Western Europe, peaking at 956.3 million requests per second. Mitigated in 0.172 seconds.
Threat Bulletin 0038: credential stuffing against a B2B SaaS platform in the Benelux
credential stuffing against a B2B SaaS platform in the Benelux, peaking at 264.1 million requests per second. Mitigated in 0.629 seconds.