← Problem Library
Security L5 SECURITY-1245 · 17 min

Password spray continues despite rate limiting because IPv6 privacy address rotation defeats the IP-only throttle key

The limiter is active, yet abuse persists because the identity used for throttling is too cheap for the attacker to rotate.

SecurityPlatform ReliabilityLevel 5Pro17 min
Scenario

An authentication surface limits requests by source IP and still sees sustained password spraying from rotating IPv6 clients.

What to check first
  • Identify the primary failure signal in the IP-Only Rate Limit Bypass scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Strengthen the throttling identity model instead of only lowering thresholds.

Questions worth viewing together
What should you verify first when Password spray continues despite rate limiting appears?

Community-field security problem inspired by public discussions where IPv6 address rotation bypassed IP-only authentication throttling. A functioning rate limiter can still fail as a defense if it keys on the wrong identity surface.

What usually causes Password spray continues despite rate limiting in production?

Teams often think the limiter is broken when the attacker is simply rotating around an overly narrow key.

What should you document after resolving Password spray continues despite rate limiting?

Modern address rotation makes naive IP-based throttling much weaker than it first appears.