3 minutes 29 seconds
At 22:07:05 UTC on 20 October 2026 a flood of HTTP/2 requests hit shieldify.ee, our own website. It sits behind the same edge as every website we protect. The flood ended at 22:10:34.
In that time the edge received 118,006,995 requests over 1,096,254 connections. The busiest second carried 1,015,237 requests. All but 88 requests were stopped at the edge. The website stayed online, and the other websites on the same edge were served normally.
A new crowd every minute
The flood started at full strength. In the second minute, 98% of the addresses had not been seen in the first. In the third, more than half were still new. A blocklist built from the first minute would have missed almost all of the second.
| Minute (UTC) | Requests | Busiest second | Addresses | Not seen before |
|---|---|---|---|---|
| 22:07 (from :05) | 51,904,719 | 1,015,237 | ≈430,000 | ≈430,000 |
| 22:08 | 31,085,972 | 939,139 | ≈290,000 | ≈285,000 |
| 22:09 | 31,088,127 | 645,221 | ≈302,000 | ≈161,000 |
| 22:10 (to :34) | 3,928,177 | 466,635 | ≈39,000 | ≈13,000 |
Home connections in 52 countries
About 889,000 distinct addresses took part, spread over about 478,000 /24 networks: fewer than two addresses per network. No country sent more than 15% of the requests.
| Country | Share of requests |
|---|---|
| United States | 14.1% |
| Russia | 13.4% |
| Brazil | 8.1% |
| United Kingdom | 5.4% |
| Canada | 3.6% |
| Mexico | 3.0% |
| France | 3.0% |
| Spain | 3.0% |
| Colombia | 2.8% |
| China | 2.5% |
| Others | 41.1% |
The largest networks were home and mobile internet providers. That is the pattern of residential proxy networks or infected home devices, not of rented servers. The largest network sent less than 4% of the requests, and the ten largest together less than 18%.
| Network | AS number | Share of requests |
|---|---|---|
| Rostelecom | AS12389 | 3.5% |
| Comcast | AS7922 | 3.5% |
| AT&T | AS7018 | 1.7% |
| Virgin Media | AS5089 | 1.4% |
| Verizon | AS701 | 1.4% |
| Uninet (Telmex) | AS8151 | 1.3% |
| Chinanet | AS4134 | 1.3% |
| Claro | AS28573 | 1.2% |
| Starlink | AS14593 | 1.2% |
| BT | AS2856 | 1.1% |
One page, seven Safaris, two Googles
Every request we sampled asked for the home page (GET /), and all but 134 of the 118 million came over HTTP/2.
About 108 requests per connection. HTTP/2 lets a client send many requests at once on one connection. The flood used that: 118 million requests needed only 1.1 million connections, so the attacker paid for far fewer TLS handshakes than the request count suggests.
Seven User-Agents in an even rotation. The requests claimed to be Safari on iPhone and iPad. Seven User-Agent strings each carried between 14.1% and 14.3% of the requests: an even rotation by the tool, not the mix real visitors produce.
| User-Agent | Share |
|---|---|
Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1 | 14.3% |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1 | 14.3% |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1 | 14.3% |
Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1 | 14.3% |
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 | 14.3% |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1 | 14.3% |
Mozilla/5.0 (iPad; CPU OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1 | 14.1% |
A Google referer on almost every request. Half named https://www.google.com/ and half https://www.google.com.tr/ (50.0% and 49.9%), to look like visitors arriving from a search.
49 GB in, 0.9 GB out. The flood sent the edge 49 GB in three and a half minutes, about 1.9 Gbit/s on average. The edge sent back 0.9 GB, less than 2% of what it received.
What this flood says about common defences
Per-address limits do not reach it
Over the whole flood each address sent about 133 requests, 0.6 a second. In the busiest minute, 430,000 addresses sent 51.9 million requests: about two a second each. A limit low enough to catch that also stops real visitors who share an address.
Blocklists arrive late
98% of the second minute's addresses were new. A list of known bad addresses, shared or your own, cannot keep up with a crowd that changes this fast.
Blocking countries or networks hits customers
The flood came from 52 countries and ordinary internet providers, the largest supplying under 4%. Blocking them would shut out real visitors long before it slowed the flood.
What tells such a flood apart from real visitors is what each client shows on its own requests and connections, not where it comes from. Shieldify decides per request and per client on that evidence, so a visitor on the same network as an attacking device still gets in.
Data and method
All figures come from Shieldify's edge, which recorded the flood as it happened. Request, connection and byte counts are exact. Distinct addresses and /24 networks are HyperLogLog estimates (about ±2%). Country, network, User-Agent and referer shares are estimated from a weighted sample of the requests. Times are in UTC. We publish no addresses.
Countries and networks: IP Geolocation by DB-IP (IP to Country Lite and IP to ASN Lite, CC BY 4.0).